Sole Global Admin locked out by MFA — need Data Protection / Tenant Recovery escalation

Question

I am the sole Global Administrator of this tenant and I am locked out. I can sign in successfully with my password, but I am stopped at the MFA screen. The only registered verification method is Microsoft Authenticator, and the app approval/verification code is tied to a physical device I no longer have access to. There is no SMS or phone-call fallback option offered, and no alternate email was ever configured.

There is no other Global Administrator in this tenant, so I cannot use another admin to reset MFA (Entra ID → Users → Authentication methods → Require re-register MFA is not available to me), and Self-Service Password Reset does not help since the block is MFA, not the password.

I control the DNS and can verify domain ownership immediately by adding a TXT record if required.

This lockout is currently blocking me from removing existing linked domain from this tenant so I can add it to a separate, active Microsoft 365 tenant that I'm setting up for active usages.

Could someone please help escalate this to the Microsoft 365 Data Protection / Tenant Recovery team for an admin MFA reset? I'm ready to provide any domain or business ownership verification needed.

Thank you for your help.

Answer 1

Good day Prashanth,  

Thank you for taking the time to share your experience. I hope this response reaches you in time and helps bring some clarity. 

Just to gently clarify before we go any further, forum users don't have the ability to access, modify, or recover user accounts. Due to security and privacy requirements, issues such as sign in failures, password recovery, and multi-factor authentication can only be addressed by Microsoft’s dedicated support teams, who have the appropriate tools and authorization to manage account level settings securely. 

This usually happens after changing devices or reinstalling the Microsoft Authenticator app before setting up MFA on the new phone. In this situation, MFA needs to be reset. However, because you are the only administrator in the tenant and cannot access the account, identity verification and account recovery can only be handled by the Microsoft Data Protection team. They are the authorized team that can assist with restoring access to your admin account.  

You can start by calling your regional Microsoft support hotline here: Customer service phone numbers - Microsoft Support    

During the phone call, you will need to provide the information associated with your subscription, such as your company name, billing details, phone number and an alternate email address, etc. This information allows the Data Protection team to verify your identity and securely assist you in regaining access to your administrator account.       

In some regions, the initial interaction may be automated, so here’s a general idea of how the conversation might go to help you prepare:      

Here are some tips and an example of a prompt to help you reach out the Microsoft Data Protection team support more effectively:   

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)         

In some countries, it is an automated conversation like:  

IVR: What kind of problem are you concerned about?        

You: Authenticator.        

IVR: What kind of product do you use?        

You: Office 365 for business.        

IVR confirmation: education or company account?        

You: For companies.        

IVR: Are you an administrator?        

You: Yes.        

IVR: Do you have another administrator in your organization?        

You: No.        

IVR: Do you need a... Service request? 

You: Yes. I need to create a ticket. Please send me directly to the Data Protection Team. 

---

If you cannot reach a live agent by phone, there is still a workaround, you might consider registering for a new tenant by signing up for a trial subscription and submit your request from there.      

Here are the reference threads showing that this workaround works: 

Sole admin recovery and MFA reset  

Error 399287 – Administrator Account Locked Out Due to MFA Verification Failure 

To set up a new tenant, please follow these steps below: 

Visit  Microsoft 365 Business Plans and Pricing | Microsoft 365. This would allow you to create a new tenant following the prompts provided. Once set up, you can access the admin console of the new tenant and submit a support ticket requesting to speak with the Data Protection team on behalf of your previous tenant.       

Follow the guided setup process to create a new account for a new tenant.   

Once your tenant is created, you should be able to access the support portal and submit your ticket referencing your locked account without further issues 

In your ticket description, you'll need to clearly explain that you're trying to regain access to your previous Microsoft 365 tenant and need help from the Data Protection team. Here's a message you can use or adapt:   

"Hello, I’m currently unable to access my previous Microsoft 365 tenant due to losing MFA access, which prevents me from receiving verification codes. I’m the global admin, but I’m locked out and unable to generate a QR code or bypass MFA.    

I created this new tenant solely to request assistance. I kindly ask to be connected with the Data Protection team so that I can verify my identity and receive help recovering access to my original tenant. 

This is urgent, as I rely on Microsoft 365 for my work and have been unable to operate for several days. I’m available to provide any documentation or verification needed to support the recovery process."   

Ticket Support: In the Microsoft 365 Admin Center > Support > Help & Support. You can raise support ticket at https://admin.microsoft.com/#/support/requests     

Please remember to cancel the trial subscription after your issue is resolved, as this will help you avoid any accidental billing. You may prefer the following resource for detailed instructions: Cancel your Microsoft business subscription in the Microsoft 365 admin center | Microsoft Learn 

I truly hope this helps you regain access to your account quickly. Even though I can't directly intervene, directing you to the correct and specialized support is the most effective help I can provide from my position.  

Thank you for your kindness and contributions to the forum.  

---

If the answer is helpful, please click "Yes" and kindly upvote it. If you have any extra questions about this answer, please click "Comment".            

Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.