Sole Global Administrator locked out by MFA — how to initiate admin account recovery?

Question

I am the sole Global Administrator of the tenant danubefashionweek.onmicrosoft.com and I am completely locked out by MFA.

Situation:

• My only registered MFA method was Microsoft Authenticator.
• The phone with the app is gone and no cloud backup was enabled, so the app cannot be restored.
• No second Global Administrator exists in the tenant, so nobody can reset MFA internally.
• At sign-in I get: "Verify your identity — Sorry, we're having trouble verifying your account." No alternative verification method is offered.

What I have already tried:

• passwordreset.microsoftonline.com (SSPR) — dead end, it requires the same inaccessible MFA method.
• The consumer Microsoft Account Sign-in Helper — does not apply, this is a work/school account in Entra ID.
• Multiple browsers, incognito mode, different devices and networks.
• "Sign in another way" — no usable option listed.
• aka.ms/mfasetup — requires sign-in, which I cannot complete.
• Phone support in several regions — either unreachable from my country or outside business hours.
• I cannot open a support ticket in the admin center because opening a ticket requires signing in.

What I am asking:

What is the correct procedure to initiate Microsoft-side admin account recovery for a tenant where the sole Global Administrator has lost all MFA methods? Is there a form, an email address, or an escalation path that does not require authenticating into the locked tenant?

I am fully prepared to prove tenant ownership: subscription and billing records, payment card details, company registration documents, and DNS control of the custom domain if a TXT record is required.

Any guidance on reaching the team that handles administrator lockouts would be much appreciated. This is currently blocking all business email for the organization.

Thank you.

Answer 1

Hello constantin ionut,

Greetings! Thanks for raising this question in Q&A forum.

I understand this is a critical situation. Since you are the only Global Administrator and the only registered MFA method is no longer available, this is no longer something that can be recovered from within the tenant. Microsoft Support will need to perform an ownership verification process before any recovery action can be considered.

1. Contact Microsoft Support through the business support channel that does not require access to the affected tenant.
2. Explain that this is a sole Global Administrator lockout caused by the loss of all MFA methods and that no other Global Administrator exists in the tenant.
3. Be prepared to provide proof of ownership, such as subscription details, billing information, company registration documents, and DNS ownership verification for the custom domain.
4. If you have access to the subscription purchase records (for example, through the reseller or CSP partner that manages the subscription), contact them as well, as they can often assist with opening a support case and validating tenant ownership.
5. Once Microsoft validates ownership, the support team will advise the available recovery options and next steps.

The next action is owned by Microsoft Support (or your CSP/reseller if applicable). The support team will need to verify tenant ownership before they can review any administrator recovery options. Unfortunately, there is no public self-service form that can bypass Entra ID authentication for this specific scenario.

If this answer helps you kindly accept the answer which will help others who have similar questions

Best Regards,

Jerald Felix.