Sole Global Administrator locked out of Microsoft 365 tenant MFA Authenticator lost after phone replacement, no other admin, need Data Protection team escalation

Question

I am the sole Global Administrator of a Microsoft 365 Business tenant for the domain

Microsoft Authenticator was the only MFA method registered on my admin account. I replaced my mobile phone and the Authenticator credential did not transfer to the new device. The Authenticator app on the phone shows the account only as a "Connected account" with no one-time passcode available.

At sign-in I am prompted only for a code from the Authenticator app. There is no "I can't use my Microsoft Authenticator app right now" option and no alternate verification method registered on the account. There is no second Global Administrator who can reset it.

I cannot raise a support ticket from within the tenant because the admin account itself is the one that is locked.

I can prove ownership of the tenant: I have registrar access for the domain and full DNS control, and can add any TXT record required for verification. I also have the subscription billing details.

Please advise how to escalate this to the Microsoft 365 Data Protection / Tenant Recovery team for an MFA reset or a Temporary Access Pass.

Answer 1

Hi Helder,

Welcome to the Microsoft Q&A forum.

Based on your description, you are the only administrator of the tenant.

In this situation, you will need to contact Microsoft's Data Protection Team through the support hotline.

Please look up the appropriate support phone number for your region and contact Microsoft's frontline support. After that, ask them to create a support ticket for you using the information provided on the Customer Service Phone Numbers – Microsoft Support page.

In this case, the Microsoft Data Protection Team is the only team with the specialized tools and procedures required to verify your identity and securely restore access to your administrator account.

Please note that moderators on the forum do not have the authority to directly intervene in user accounts, especially for issues related to:

• Account sign-in
• Password resets
• MFA authentication
• Changing or restoring access permissions

Tips for Navigating the IVR System (Automated Phone Support)

To help you navigate the IVR system more effectively, please refer to the guidance below:

1. When calling the support number, you may hear an introductory message that lasts about 30 seconds (for example: "You can visit the link..."). You can skip this part and wait until the system presents the available options.
2. Then:
   • Press 1 > as a business email user.
     • Press 1 again > for technical support.

In some regions, the initial interaction may be fully automated. Below is a sample dialogue you can prepare in advance:

• What kind of problem are you experiencing? Answer: Authenticator
• What products do you use? Answer: Office 365 for Business
• Is this for an education or company account? Answer: For companies
• Are you an administrator? Answer: Yes
• Are there any other administrators in your organization? Answer: No. I am the only admin in my tenant.
• Do you need a service request? Answer: Yes. I need to create a ticket. Please send me directly to the Data Protection Team.

During the call, you may be asked to provide subscription-related information such as:

• Company name
• Billing information
• Contact phone number
• Alternate email address

This information helps the Data Protection Team verify your identity and securely assist with restoring access to your account.

I hope this information is helpful. Please follow these steps and let me know if it works for you. If not, we can work together to resolve this.   

Thank you for your patience and your understanding. If you have any questions or need further assistance, please feel free to share them in the comments on this post so I can continue to support you.

I look forward to continuing the conversation.

---

If the answer is helpful, please click "Yes". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.