Sole Global Admin locked out - SMS MFA fails server-side with error 399287

Question

I am the only Global Administrator of a small company tenant and I cannot sign in. There is no second administrator account, so I cannot get help from inside the tenant, and I cannot open a support ticket from an admin center I cannot reach.

What happens

Password authentication succeeds. Multi-factor authentication then fails on the server side, before any code is sent or entered. The only MFA method registered on the account is SMS text message. The phone is active and receives other SMS normally. The error shown is: "Sorry, we're having trouble verifying your account. Please try again."

Diagnostic details

Error Code: 399287 [Moderator note: Personally Identifiable Information removed] [Moderator note: Personally Identifiable Information removed]

What I have already tried

Signed out fully and started a clean sign-in flow at login.microsoftonline.com/common/login. Same failure, so this is not a stale session or a bad deep link from a billing email.

Requested the SMS code again multiple times. Same failure every time.

aka.ms/mfasetup is not usable, because it requires the same MFA.

Self-service password reset does not help, for the same reason.

Called Microsoft support on both Hungarian numbers. The automated phone system disconnects the call before reaching an agent.

What I am asking for

First, escalation to the Data Protection Team so the MFA registration on my admin account can be reset and I can regain access to the tenant.

Second, and separately, a way to receive a copy of a specific monthly invoice by email. My accountant needs it and it should not have to wait for the account recovery to complete.

I can prove ownership of the tenant with recent invoice numbers, the exact recurring charge amount, the last digits of the payment card and the company registration details. I will provide these privately to whoever picks this up.

Any guidance on how to reach a human at Microsoft for a sole-admin lockout would be appreciated. Thank you.

Answer 1

Hi Ferenc,

Welcome to the Microsoft Q&A forum.

Based on the error code you provided, error 399287 may occur when the system detects unusual activity on your device. In such cases, the system may mark your device as having a bad reputation in order to help protect the information and data stored within the tenant.

To contact Microsoft's Data Protection Team and have your phone number marked as safe within the system, you will need to call Microsoft's support hotline using the guidance provided in the document below:

Contact Microsoft customer support | Microsoft Support

Note: This is a community forum where users share information and assist one another. Moderators in this forum cannot directly escalate issues to the Data Protection Team, nor can they assist with requests such as obtaining copies of monthly invoices. These types of requests must be handled by the appropriate Microsoft support teams.

Additionally, you may follow the steps below when calling support to improve the chances of being routed to the correct department:

• When calling the support number, you may hear an automated introduction that lasts approximately 30 seconds (for example: "You can visit the link..."). You can simply wait for it to finish and then proceed when the support options are presented.
• Then:
•  
  • Press 1 for business email users.
    • Press 1 again to select Technical Support.

In some regions, the initial interaction may be fully automated. You may want to prepare the following responses in advance:

• What kind of problem are you experiencing? Answer: Authenticator
• What products do you use? Answer: Office 365 for business
• Is this for an education or company account? Answer: For companies
• Are you an administrator? Answer: Yes
• Are there any other administrators in your organization? Answer: No. I am the only admin in my tenant.
• Do you need a service request? Answer: Yes. I need to create a ticket. Please connect me directly with the Data Protection Team.

During the call, you may be asked to provide information related to your subscription, such as:

• Company name
• Billing information
• Contact phone number
• Alternative email address

This information will help the Data Protection Team verify your identity and assist you in restoring access to your tenant securely.

 I hope this information is helpful. Please follow these steps and let me know if it works for you. If not, we can work together to resolve this.   

Thank you for your patience and your understanding. If you have any questions or need further assistance, please feel free to share them in the comments on this post so I can continue to support you.

I look forward to continuing the conversation.

---

If the answer is helpful, please click "Yes". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread