Sole Global Admin locked out — MFA/SMS failing, CSP cannot raise DP case, phone identity verification unsuccessful

Question

Hello,

I am reaching out regarding a Microsoft 365 tenant lockout affecting a client organization where I act as their IT partner (CSP).

Situation:

• This is the only Global Administrator account in the tenant, and there is no other admin who can assist.
• The Microsoft Authenticator app was registered on a previous device that is no longer available.
• SMS verification codes to the registered phone number are not being received.
• No other alternative MFA methods are configured.
• The account is completely locked out and self-service recovery is not possible.

What we've already tried:

• Our CSP partner confirmed that, per current Microsoft policy, they are not permitted to raise a Data Protection (DP) case on the customer's behalf — this must come directly from the Global Admin.
• The Global Admin called Microsoft Support directly, but the call could not proceed past the initial identity/security verification step, since the standard security questions rely on account details tied to the very account that is locked out.

Request: Could a Microsoft representative please help escalate this to the Data Protection / Tenant Recovery team so they can verify tenant ownership through alternative means (business documentation, domain ownership, billing details) and assist in resetting the authentication method for this Global Admin account?

I'm glad to share tenant/domain/contact details privately once someone reaches out, since that information shouldn't be posted publicly.

Thank you for your assistance.

Answer 1

As you have correctly found out, you cannot act on behalf of a customer to reset the global admin password.

In the event of a total admin lockout, meaning no alternative admins, delegated admins, emergency access accounts etc....

I can suggest a few pathways forward -

1. Raise a support ticket on their behalf. The CSP customer in any case can't raise a support ticket on their own from their tenant, so as the CSP partner you have this ability. Reference the customer's global admin as the future contact point on this matter and see what MS Support says.
2. Have the Global Admin call Microsoft directly. To get to a support engineer, there is no need for detailed verification. However there is a automated attendant that may route the customer to websites etc which does not help. The customer needs to explain to support about being locked out and request for data protection team. I will paste my script at the end of this post they can try using.
3. Create a demo tenant and raise a support ticket from there. Again this needs to be done by the customer global admin.

Calling Support
https://support.microsoft.com/en-us/topic/customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2

These phone numbers have Interactive Voice Response agent (IVR). Due to phone connection quality, and also your accent, some people have feedback that they have difficulty talking to a person. So using a good phone line, speaking slowly and clearly, might be an important factor.

Others have feedback that following this script might be helpful

IVR: What kind of problem are you concerned about? 

You: Authenticator. 

 

IVR: What kind of product do you use? 

You: Office 365 for business. 

 

IVR confirmation: education or company account? 

You: For companies or For education

 

IVR: Are you an administrator? 

You: Yes. 

 

IVR: Do you have the other administrator in your organization? 

You: No. 

 

IVR: Do you need a... Service request? 

You: Yes 

 

Answer 2

Please note that we are not Microsoft support; this is a user-to-user support forum. Moderators do not have access to internal systems and cannot intervene directly in Microsoft products. We only offer technical guidance and best practice recommendations based on reported issues. Although I cannot directly assist you, I can show you the steps how to contact Microsoft support.

Hello @Justas Besakirskas | SIMPLIT

If you have tried phone support but no luck, please go to this link to create a trial tenant: https://www.microsoft.com/en-us/microsoft-365/business/microsoft-365-business-basic?msockid=3eb6980b5c6860e63a588d0c5d1761d6 – after that, you'll be able to go to the Microsoft 365 Admin Center to open a ticket.

Assuming you've already created an account after registering the free trial, you can go to the "Microsoft 365 Admin Center" and click on the Help & Support icon to open the ticket. The agent can create a ticket for the affected tenant and then transfer it to the Data Protection team, who can help them regain access.

Please mention that you are opening the ticket on behalf of the affected tenant to which you do not have access. The support team will help you create the ticket for the affected tenant, and then the Microsoft Data Protection team will provide assistance.

Note: This process will take longer than usual (7-14 business days) for you to regain access to your account, as the Data Protection team is often overwhelmed with the volume of tickets. As a forum moderator, I don't have access to Microsoft's internal systems to help or speed up this process.

On the other hand, if you create the trial account and it resolves the issue, remember to cancel the subscription later to avoid being charged.

I hope this information is useful. Please keep me posted once the issue is resolved.

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.