Lost Access to Microsoft Entra ID tenant

Question

I am the only Global Administrator of a free Microsoft Entra ID tenant (2z1m6g.onmicrosoft.com). I know the account password, but I lost the Microsoft Authenticator registration after replacing/reinstalling my phone. The account has no alternate authentication methods and no second Global Administrator. Is there any supported recovery process to regain administrative access to this tenant?

Thanks!

Gab

Answer 1

Dear @Lele Presti,

Good day! Welcome to Microsoft Q&A forum!

From what you’ve described, it seems you are the only Global Administrator and is currently unable to sign in due to an authentication issue. I’m really sorry you’ve been dealing with this. I understand how frustrating it is to keep trying but not get a clear resolution.

Since there are no other admins or recovery options, the Microsoft Data Protection team must perform the reset, and they can only be reached through Microsoft Support.

Please note that I have no control over user accounts, especially when it comes to logging in to your account, resetting your password, changing your access, etc. 

Therefore, if you are the only administrator in your organization, then you need to involve Microsoft Data Protection Team. Please try to find the related hotline number to call the frontline let them raise a ticket for you: Technical or Sales support phone numbers (for Work account, scroll down to find your region's number) 

In some countries, this is an automated conversation: First, when you call the hotline, they will ask you what kind of problem you are struggling with. 

Answer: Authenticator. 

A: What products do you use? 

B: Office 365 for business. 

Verification: Education or company account? 

B: For companies 

A: Are you an administrator? 

B: Yes. 

A: Are there any other administrators in your organization? 

B: No. 

A: I need one.... Service request? 

B: Yes 

(Important Note: Sometimes, you would hear the computer-generated voice at first, please kindly wait for it to end, and if an agent is available, you would be directed to them and get your support. Depending on your country or region, when you call the support number, you may hear an introduction of about 30 seconds such as "You can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.) 

As an alternative, you can create a new tenant account and submit your request from there.    

To set up a new tenant, please follow these steps: 

• Visit Compare Office 365 Enterprise Pricing and Plans | Microsoft 365, choose any plan and click try for free to start a free trial.    
• Follow the guided setup process to create a new account for a new tenant. 

Once your tenant is created, you should be able to access the support portal and submit your ticket referencing your locked account without further issues.

In the ticket's description, you could refer to this message "Hello,

I am currently locked out of my Microsoft 365 tenant because multi-factor authentication is enforced, and I am unable to complete the verification process. I am the only global administrator for this tenant, which means I cannot access my account or the Microsoft 365 Admin Center.

To resolve this, I have created a new tenant and would like to be connected with the Data Protection Team to verify my identity and assist with regaining access. I am available to provide any required documentation or verification to support the recovery process."

Ticket Support: Log in the Microsoft 365 Admin Center using the newly created trial admin account (not the currently locked one) > Support > Help & Support. You can raise support ticket at: https://admin.microsoft.com/#/support/requests

• After clicking on "Help & Support" button, you can type "I need agent support via phone or email". After that, you can click on "Contact support" 
• Choose contact method: "Phone" 
• Fill all the information in this contact support details, please describe your situation carefully so they will have enough information to help you. 
• Finally, click on "Contact me"
• After completing them, you will receive an email appointment for a meeting to review this issue professionally together. 
• For more details, you could refer to this article: Get support for Microsoft 365 for business 

Please remember to cancel the trial subscription once your issue is resolved to avoid any unintended charges.

Kindly let me know when there are updates or if you need further assistance. Any updates you’re able to share would be really helpful.

I'm here and happy to help! Thank you for your kindness and patience! 

---

If you have additional questions regarding this response, kindly click 'Comment'.

Note: Please follow the steps in forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Thank you both! Will raise a support request as advised! thanks again!

Answer 3

Thank you both for your response; it is appreciated.

I will follow it up with Ms Support and update the thread!

Thanks again.

Answer 4

Thank you both for your response; it is appreciated @Julie Huynh & @gohel dhruvisha

I will follow it up with Ms Support and update the thread!

Thanks again.

Answer 5

Yes, but not self-service. If you're the only Global Administrator, have no alternate MFA methods, and no second Global Administrator, there is no supported self-service way to bypass or reset Microsoft Authenticator. The supported recovery path is through Microsoft Support's Data Protection / Tenant Recovery process, where Microsoft verifies your identity and tenant ownership before resetting the MFA registration.

The supported process is:

1. Contact Microsoft Support by phone and explain that:
   • You're locked out of a Microsoft Entra ID tenant.
     • You're the only Global Administrator.
       • You lost your Microsoft Authenticator registration after replacing/reinstalling your phone.
         • There are no other authentication methods and no second Global Administrator.
           • You need the case escalated to the Data Protection / Tenant Recovery team.
           1. Complete Microsoft's identity verification process. If they can verify your ownership of the tenant, they can reset the MFA registration so you can sign in and register a new authenticator.

If you're unable to open a support case because you can't sign in (common with free tenants), Microsoft moderators have suggested creating a temporary Microsoft 365 trial tenant solely to open a support request for the affected tenant, or contacting Microsoft support by phone directly and asking for escalation to the Data Protection team.

For the future, after regaining access, Microsoft recommends reducing the risk of lockout by:

• Having at least two Global Administrators.
• Registering multiple MFA methods (for example, Authenticator plus a security key or another supported method).
• Maintaining a break-glass (emergency access) administrator account with carefully controlled credentials.Yes, but not self-service. If you're the only Global Administrator, have no alternate MFA methods, and no second Global Administrator, there is no supported self-service way to bypass or reset Microsoft Authenticator. The supported recovery path is through Microsoft Support's Data Protection / Tenant Recovery process, where Microsoft verifies your identity and tenant ownership before resetting the MFA registration. The supported process is:
  1. Contact Microsoft Support by phone and explain that:
     • You're locked out of a Microsoft Entra ID tenant.
     • You're the only Global Administrator.
     • You lost your Microsoft Authenticator registration after replacing/reinstalling your phone.
     • There are no other authentication methods and no second Global Administrator.
     • You need the case escalated to the Data Protection / Tenant Recovery team.
  2. Complete Microsoft's identity verification process. If they can verify your ownership of the tenant, they can reset the MFA registration so you can sign in and register a new authenticator.
  If you're unable to open a support case because you can't sign in (common with free tenants), Microsoft moderators have suggested creating a temporary Microsoft 365 trial tenant solely to open a support request for the affected tenant, or contacting Microsoft support by phone directly and asking for escalation to the Data Protection team. For the future, after regaining access, Microsoft recommends reducing the risk of lockout by:
  • Having at least two Global Administrators.
  • Registering multiple MFA methods (for example, Authenticator plus a security key or another supported method).
  • Maintaining a break-glass (emergency access) administrator account with carefully controlled credentials.