How to get a custom domain removed from a tenant I'm locked out of (sole admin, lost MFA)?

Question

Hello,

I need guidance on the correct process for the following situation.

A custom domain is verified in a Microsoft Entra tenant that I can no longer access:

• I am (was) the only Global Administrator of that tenant.
• I have permanently lost access to my MFA / second factor, so I can't sign in.
• There is no other administrator, and self-service recovery doesn't work (the lost factor was my only registered method).

My goal is simply to have that custom domain removed/released from the tenant so it can be re-verified elsewhere. I fully control the public DNS of the domain and can prove ownership with any TXT record required.

Thanks in advance

Answer 1

Hello @Antoine,

Based on the scenario you described, this is generally considered a tenant lockout situation because you were the only Global Administrator and the only registered MFA method is no longer available. In this case, neither forum moderators nor Microsoft Q&A contributors can remove the domain directly. Microsoft's identity verification process must be followed.

Since the custom domain is still attached to the inaccessible tenant, the usual approach is to contact Microsoft Support and request escalation to the Data Protection / Tenant Recovery team. This team can verify ownership of the tenant and domain and determine the available recovery options.

Please try to find the related hotline number to call the frontline and let them raise a ticket for you: Customer service phone numbers - Microsoft Support 

Depending on your country or region:

For some countries, when calling the support number, although there are about 30 seconds opening as something "you can visit the link...." But you can ignore this opening and wait until the option, then "1" as a business email user, "1" again for technical help.   

For some countries, it will be an automated conversation like:    

• First, when you call the hotline, it asks what kind of problem you are worried about.   
• Answered: authenticator.   
• A: What kind of product are you using?   
• B: Microsoft 365 for business.   
• A confirmation: education or company account?   
• B: For companies   
• A: Are you an administrator?   
• B: Yes.   
• A: Do you have the other admin in your organization?   
• B: No.   
• A: You need one.... Service request?   
• B: Yes   

Note:

• You may need to call multiple times before you are connected to a live support representative and can successfully create a support request with a ticket number for tracking. 
• If your subscription is from a partner or reseller, contact the reseller's support provider to help open a service request on behalf of you instead.   

When contacting support, be prepared to provide:

• The tenant's custom domain name.
• The Global Administrator account (UPN) that is locked out.
• Confirmation that no other Global Administrators exist.
• Proof of domain ownership (such as the ability to add a DNS TXT record).
• Any subscription, billing, or business ownership information associated with the tenant.

As an end user, my understanding is that there is no public self-service process to release a custom domain from a managed tenant when the sole administrator is locked out. Microsoft Support must first verify ownership before they can assist with recovery or domain release.

I hope this helps clarify the next steps.

Kind Regards.

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.