Locked out of Global Admin account – MFA authenticator removed, cannot access any portal or support

Question

Our administrator removed the Microsoft Authenticator app from her phone. During reinstallation the TOTP codes were lost. The account is now fully locked out — every login attempt for accounts@ is blocked at the MFA prompt with error code 500121.

What I have tried

• aka.ms/recoveraccount — redirects to a login page I cannot access
• Microsoft Support chat and phone (0800-020 32 35) — every option routes back to a portal that requires the same MFA login
• Support form submission — no response
• The AI support line could not help and sent me back to the portal repeatedly

Current impact

• Cannot access Microsoft 365 Admin Center
• Cannot update expired payment method on the subscription
• No fallback admin account exists on this tenant

What I need A way to reach the Microsoft Data Protection team for a manual MFA reset / tenant recovery — or an offline verification method (DNS record, billing info) that does not require portal access.

Error details: Error Code: 500121 | Timestamp: 2026-06-29T08:36:07ZOur administrator removed the Microsoft Authenticator app from her phone. During reinstallation the TOTP codes were lost. The account is now fully locked out — every login attempt for accounts@ is blocked at the MFA prompt with error code 500121.

What I have tried

• aka.ms/recoveraccount — redirects to a login page I cannot access
• Microsoft Support chat and phone (NL) — every option routes back to a portal that requires the same MFA login
• Support form submission — no response
• The AI support line could not help and sent me back to the portal repeatedly

Current impact

• Cannot access Microsoft 365 Admin Center
• Cannot update expired payment method on the subscription
• No fallback admin account exists on this tenant

What I need
A way to reach the Microsoft Data Protection team for a manual MFA reset / tenant recovery — or an offline verification method (DNS record, billing info) that does not require portal access.

Error details: Error Code: 500121 | Timestamp: 2026-06-29T08:36:07Z

Answer 1

Hi Welcome app team

You might need to contact Microsoft Support team via phone service number: Customer service phone numbers - Microsoft Support. The agent will be able to create a ticket for you under the affected tenant and then transfer this ticket to Data Protection team who could help you to regain access.  

When a call is made to support, the first step is to provide an automated voice response from AI. Be careful, you won't be able to speak to a support representative if you don't respond appropriately here. 

Here's an example of a response that actually led to a support representative. Please refer to it. 

Q. Can you tell me if you are calling as a home user who uses a product or service at home or a business user who uses it in your business to provide the best assistance? 
A.I am a business user. 
Q. Thank you. Can you give me the details of your inquiry? 
A. Login technical support. 
Q. First of all, can you tell me which products you are inquiring about today? 
A. Microsoft 365 business Standard。 
Q. Please wait a moment, I understand Microsoft 365. Are you calling about a new case or an existing one? 
A. New. 
Q. To receive phone support, your phone number must be associated with your Microsoft 365 admin profile. To do this, go to aka.ms/m365profile. Again, it aka.ms/m365profile . This can take 48 hours. In the meantime, you can go to aka.ms/m365profile and file a case online. If you prefer, you can also text the link to the phone number you are calling. What do you think? 
A. The phone number is already linked to the link. 
Q. Can you tell me about the products in your inquiry? 
A. Microsoft 365 Business Standard. 
Q. Are you a Global Administrator? 
A. That's right. 
Q. I'm sorry. I didn't understand. Are you a global administrator for your domain? 
A. Yes, I am a global administrator for the domain. 
Q. If you have any inquiries, you can contact a Microsoft representative. Are you sure? 
A. Yes. Please. 
Q. Yes, I understand. Please wait a moment.

Please note that this team is always overwhelmed, so you might need to wait for them to call you, this should take 3-10 working days.

In case the phone line is not supportive, you can consider directly submitting a support request as a helpful workaround:    

-Create a temporary Microsoft 365 tenant using a trial license: Go to Microsoft 365 Business Plans and Pricing and click Try for free to set up a temporary Microsoft 365 tenant with a trial license.    

-Use this new account to sign in to the Microsoft 365 Admin Center and submit a support request on behalf of your primary (locked) account.   

-Select the Help & support (headset) icon. If Support Assistant is enabled, turn it off > Type contact support in the search box > Select Contact support, then choose Phone or Email to submit your request.  

Note: This method doesn't require you to use your new account for your business. Instead, it allows you to create a temporary global administrator account so you can submit a support request, as your original global administrator account is locked out due to issues with multi-factor authentication. The trial account is free for one month. Be sure to delete it after submitting your support request to avoid any automatic renewals or charges from Microsoft.     

For further instructions, you can follow this guide: Get support - Microsoft 365 admin | Microsoft Learn.   

I hope this helps.

---

If the answer is helpful, please click "Yes". If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.  

 

Answer 2

Error 500121 means the Microsoft Entra MFA challenge could not be completed. Reinstalling Microsoft Authenticator does not restore the original authentication registration for a work or school account. Microsoft states that Authenticator backup only transfers the account name for these accounts; the user must sign in and complete the setup again.

Because this is the only Global Administrator account and there are no alternative authentication methods or emergency access accounts, the MFA registration cannot be reset through self-service recovery. The aka.ms/recoveraccount route will not reset Microsoft Entra authentication methods for a tenant administrator.

Before contacting support, check whether the administrator still has an active session in another browser profile, device or admin application. If an existing session can still access Microsoft Entra, use it to create another cloud-only Global Administrator account. That account can then open:

Microsoft Entra admin centre > Entra ID > Users > affected administrator > Authentication methods > Require re-register multifactor authentication

If no active administrative session exists, Microsoft Support must open a tenant recovery case and escalate it to the Data Protection team.

The current Microsoft Engage Centre numbers listed for the Netherlands are:

Netherlands: +31 20 5001086 Alternate English support: +44 344 800 8338

When dealing with the automated system, use wording similar to:

Product: Office 365 for business Issue: Authenticator or administrator account locked out Account type: Business Are you an administrator: Yes Are there other administrators: No Request: Create a service request for a sole Global Administrator MFA lockout and escalate it to the Data Protection team

State clearly:

I am the sole Global Administrator of a Microsoft 365 tenant. The only administrator account cannot complete MFA, no alternative authentication methods exist, and there is no emergency access account. I need a tenant recovery case opened and escalated to the Data Protection team.

Have the following information ready for private verification:

1. The tenant’s custom domain and its onmicrosoft.com domain.
2. The affected administrator username.
3. The tenant ID, if available.
4. Subscription, invoice and billing information.
5. The organisation’s registered address and contact details.
6. Access to the public DNS zone in case Microsoft requests a TXT record.
7. The error timestamp, Request ID and Correlation ID.
8. An alternative email address and telephone number that can be contacted without using the locked tenant.