Sole Global Administrator locked out by MFA — how to initiate admin account recovery

Question

I am the sole Global Administrator of the tenant [Moderator note: Personally Identifiable Information removed].onmicrosoft.com and I am completely locked out by MFA.

Situation:

• My only registered MFA method was Microsoft Authenticator.
• The phone with the app is gone and no cloud backup was enabled, so the app cannot be restored.
• No second Global Administrator exists in the tenant, so nobody can reset MFA internally.
• At sign-in I get: "Verify your identity — Sorry, we're having trouble verifying your account." No alternative verification method is offered.

What I have already tried:

• passwordreset.microsoftonline.com (SSPR) — dead end, it requires the same inaccessible MFA method.
• The consumer Microsoft Account Sign-in Helper — does not apply, this is a work/school account in Entra ID.
• Multiple browsers, incognito mode, different devices and networks.
• "Sign in another way" — no usable option listed.
• aka.ms/mfasetup — requires sign-in, which I cannot complete.
• Phone support in several regions — either unreachable from my country or outside business hours.
• I cannot open a support ticket in the admin center because opening a ticket requires signing in.

What I am asking:

What is the correct procedure to initiate Microsoft-side admin account recovery for a tenant where the sole Global Administrator has lost all MFA methods? Is there a form, an email address, or an escalation path that does not require authenticating into the locked tenant?

I am fully prepared to prove tenant ownership: subscription and billing records, payment card details, company registration documents, and DNS control of the custom domain if a TXT record is required.

Any guidance on reaching the team that handles administrator lockouts would be much appreciated. This is currently blocking all business email for the organization.

Thank you.

Answer 1

Hi,

Thank you for taking the time to provide such detailed information about the situation and the troubleshooting steps you have already completed. 

Based on the information provided, it appears that the tenant's only Global Administrator account is currently inaccessible because all registered Multi-Factor Authentication (MFA) methods associated with the account, including Microsoft Authenticator and the registered phone number, are no longer available. 

In this scenario, the primary issue is that the Global Administrator account requires an MFA reset before access to the Microsoft 365 tenant can be restored. Because there are no alternative authentication methods configured and no additional Global Administrator accounts available within the tenant, the standard self-service recovery options are unable to verify account ownership and therefore cannot be used to regain access. 

As a result, this situation requires assistance from Microsoft Support to perform an administrator account recovery review. Microsoft may request proof of tenant ownership, such as subscription and billing information, payment details, domain ownership verification, or business registration documentation, before they can consider resetting MFA for the affected administrator account. 

Just to gently clarify before we go any further, forum moderators do not have the ability to access, modify, or recover user accounts. Due to security and privacy requirements, issues such as sign in failures, password recovery, and multi factor authentication can only be addressed by Microsoft’s dedicated support teams, who have the appropriate tools and authorization to manage account level settings securely.     

To move toward a resolution, I suggest the following steps:     

Option 1: Contact Microsoft Data Protection Support by Phone (Primary Method)           

Since you are the only administrator of your tenant and you’re currently unable to sign in, the next essential step is to involve the Microsoft Data Protection team, as they are the only team authorized to help recover an admin account in these circumstances. You can start by calling your regional Microsoft support hotline here: Customer service phone numbers - Microsoft Support and choose Work account.     

  

  

During the phone call, you will need to provide the information associated with your subscription, such as your company name, billing details, phone number, and an alternate email address, etc. This information allows the Data Protection team to verify your identity and securely assist you in regaining access to your administrator account.            

In some regions, the initial interaction may be automated, so here’s a general idea of how the conversation might go to help you prepare:           

Here are some tips and an example of a prompt to help you reach out the Microsoft Data Protection team support more effectively:        

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)              

In some countries, it is an automated conversation like:       

IVR: What kind of problem are you concerned about?             

You: Authenticator.             

IVR: What kind of product do you use?             

You: Office 365 for business.             

IVR confirmation: education or company account?             

You: For companies             

IVR: Are you an administrator?             

You: Yes.             

IVR: Do you have another administrator in your organization?             

You: No.             

IVR: Do you need a... Service request?      

You: Yes. I need to create a ticket. Please send me directly to the Data Protection Team.    

  

You will need to complete a tenant ownership verification with Microsoft’s Data Protection Team. This process generally involves submitting the following documentation:    

• Proof of domain ownership, such as access to manage DNS records    
• Billing or subscription information, including payment methods or account history    
• The Tenant ID of the affected Microsoft 365 organization    
• Official business registration documents    
• Documentation confirming you are an authorized signatory for the business.  

Option 2: Create a Temporary Account (Trial Tenant) to Submit a Support Ticket (Alternative Method)       

If you cannot reach a live agent, there is still a workaround, you might consider registering for a new tenant by signing up for a trial subscription.      

To set up a new tenant, please follow these steps:      

Visit Microsoft 365 Business Plans and Pricing | Microsoft 365. This would allow you to create a new tenant following the prompts provided. Once set up, you can access the admin console of the new tenant and submit a support ticket requesting to speak with the Data Protection team on behalf of your previous tenant.      

Follow the guided setup process to create a new account for a new tenant.      

Once your tenant is created, you should be able to access the support portal and submit your ticket referencing your locked account without further issues.      

In your ticket description, you'll need to clearly explain that you're trying to regain access to your previous Microsoft 365 tenant and need help from the Data Protection team. Here's a message you can use or adapt:      

"Hello, I’m currently unable to access my previous Microsoft 365 tenant due to losing MFA access, which prevents me from receiving verification codes. I’m only the global admin, but I’m locked out and unable to generate a QR code or bypass MFA.   

I created this new tenant solely to request assistance. I kindly ask to be connected with the Data Protection team to verify my identity and help me recover access to the original tenant.      

This is urgent, as I rely on Microsoft 365 for my work and have been unable to operate for several days. I’m available to provide any documentation or verification needed to support the recovery process."      

Ticket Support: In the Microsoft 365 Admin Center > Support > Help & Support.      

Please remember to cancel the trial subscription after your issue is resolved, as this will help you avoid any accidental billing. You may prefer the following resource for detailed instructions: Cancel your Microsoft business subscription in the Microsoft 365 admin center | Microsoft Learn      

I truly hope this helps you regain access to your account quickly. Even though I can't directly intervene, directing you to the correct and specialized support is the most effective help I can provide from my position.       

Thank you for your kindness and contributions to the forum.      

---

If the answer is helpful, please click "Yes". If you have extra questions about this answer, please click "Comment".        

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.