Locked Out as Sole Global Admin

Question

I am the sole administrator of the tenant. The sign-in process requires Multi-Factor Authentication through Microsoft Authenticator; however, the device in which the Authenticator app is not working and I am unable to approve the sign-in request or complete the verification process. I have created it using Business account.

As a result:

• I cannot sign in to the Microsoft 365 Admin Center.
• I cannot access the Entra Admin Center.
• I cannot manage users, MFA settings, or authentication methods.
• There are no alternative Global Administrators available to reset my authentication methods.

I need assistance with:

1. Regaining access to the tenant.
2. Resetting or removing the registered MFA methods.
3. Recovering administrative access as the sole Global Administrator.

Answer 1

Please note that this forum is a community support space, so I don’t have the ability to access tenant data or perform actions such as resetting MFA/security information directly. I can only guide you based on documented processes and experience, but I will do my best to point you in the right direction so this can be resolved properly.

---

Hi @Ibrahim Shakir, 

I hope you’re having a good day. 

If you encounter difficulties reaching Microsoft Support by phone, you may consider creating a separate Microsoft 365 trial tenant using a different email address.

Please follow this link to create a trial tenant: Compare Office 365 Enterprise Pricing and Plans | Microsoft 365 - after that you will be able to access to Microsoft 365 Admin Center to raise the ticket

Assuming that you have already created an account after registering a free trial and you can go to Microsoft 365 admin center and click Support > Help & support icon to raise your ticket. The agent will be able to create a ticket for you under the affected tenant and then transfer this ticket to Data Protection team who could help you to regain access.

Please mention that you are raising ticket on behalf of the affected tenant that you do not have access to. The support team will help you to create ticket on the affected tenant then later on the Microsoft Data Protection team will assist you.

Note: This process will take more time than usual (7-14 working days) for your account to get access again as Data Protection is always overwhelmed with the number of tickets. As I am forum moderator, I do not have access to Microsoft internal system to assist or push this process to be quicker.

If you do create the trial and it resolves the issue, please remember to cancel the subscription afterward to avoid any related charges. This new trial tenant will not give you access to any of the data or settings in your original locked tenant. It is solely a temporary means to contact Microsoft support.   

I hope my information is helpful. Please give me any updates once you get this resolved.

Warm regards, 

---

If the answer is helpful, please select "Yes" and kindly upvote it. If you have extra questions about this answer, please click "Comment".    

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.   

Answer 2

Dear @Ibrahim Shakir

If there is no other Global Administrator available in the tenant, this needs to go through Microsoft's tenant recovery process.

I would recommend contacting Microsoft Support and explicitly describing this as a tenant lockout / no accessible Global Administrator case.

You can start here:

Microsoft Entra – Get support

If you prefer to call Microsoft Support, the exact phone menu depends on your country or region. In some countries, there is an initial message telling you to visit the online support page. You can simply wait for the menu options.

In other countries, the call may be handled by an automated conversation. For example:

1. What kind of problem are you concerned about?
   1. Authenticator
2. What kind of product are you using?
   1. Office 365 for business/Azure portal/Entra ID
3. Is this an education or company account?
   1. Company
4. Are you an administrator?
   1. Yes
5. Do you have another administrator in your organization?
   1. No
6. You need to create a service request.
   1. Yes

The exact wording may differ depending on the country and the current phone system, but the important part is to get the call converted into a support/service request.

Once you reach a support engineer, I would be very explicit:

“This is a Microsoft Entra tenant lockout. The only Global Administrator account is no longer accessible, and there are no other Global Administrators in the tenant. We need to recover administrative access to the tenant. Please escalate this case to the Data Protection / Tenant Recovery team.”

Have the following information ready for the ownership verification:

• Tenant ID
• Initial *.onmicrosoft.com domain
• Custom domain name(s)
• Proof of domain ownership / DNS access
• Microsoft 365 subscription and billing information
• Company information
• Details about the previous Global Administrator
• Any other information Microsoft requests to verify ownership

For future protection, I would also recommend having at least two independently managed Global Administrator accounts and dedicated emergency access accounts. This prevents losing access to the entire tenant when a single administrator account becomes unavailable.

---

If this answers your query, please click Accept Answer and Upvote if you found it helpful. If you have any further questions, feel free to let us know.