Sole Global Admin locked out by MFA loop — Authenticator restored from iCloud shows “Sign in to add the account”

Question

Hello,

I am locked out of my Microsoft 365 / Entra ID work account and I need guidance on the correct recovery path.

Situation:

•	My Microsoft Authenticator app was restored from an iCloud backup on my iPhone. The work account is listed in the app, but with a red warning icon and the message “Sign in to add the account”.

•	When I tap “Sign in”, the Microsoft sign-in page asks me to enter the verification code shown in the Authenticator app — but the app cannot generate any code, because the account was never fully restored. This is a complete loop with no way out.

•	I know my password and I still have access to my domain mailbox.

•	I checked “Sign in another way”: no usable alternative verification method is registered (no phone number, no recovery codes).

•	There is no other Global Administrator in the tenant.

Request:

I need the MFA / authentication methods of my account to be reset, so I can re-register Microsoft Authenticator on my device. As far as I understand, this scenario requires a Data Protection / Tenant Recovery case. Could you please confirm the correct procedure to open one, or escalate this request?

I can prove ownership of the tenant: I am able to add a TXT record to the DNS of my custom domain, and I can provide the tenant ID, the admin UPN, the .onmicrosoft.com domain and the billing details privately to the support agent.

Thank you for your help

Answer 1

Hi Antonio,

Because you are the sole Global Administrator in the tenant and no alternative MFA methods are registered, self-service recovery cannot complete.

Here is the exact recovery procedure:

1. Call Business Support: Contact Microsoft Support by phone for your country/region: Global Customer Service Phone Numbers.
2. Request Data Protection Escalation: State clearly: "I am the sole Global Administrator locked out by MFA after a device restore, and I need a Data Protection Case opened."
3. Domain Ownership Verification: A Data Protection engineer will verify tenant ownership by issuing a custom TXT record to add to your DNS zone before resetting your MFA options.

Ref: Get support for Microsoft 365 for business

Note: Q&A moderators cannot access tenant backend systems to reset MFA.