Sole Global Administrator locked out of Microsoft Entra tenant – MFA error 399287 – Data Protection / Tenant Recovery needed

Question

I am the sole Global Administrator of an old Microsoft Entra / Microsoft 365 tenant and I am completely locked out due to MFA.

Tenant domain: metalwood751.onmicrosoft.com

The administrator password is known and I have successfully reset it multiple times. I also still have access to both the registered recovery email address and the registered mobile phone number.

During sign-in, Microsoft correctly offers SMS verification to my registered phone number. However, clicking “Send SMS” does not send any SMS and authentication immediately fails with error code 399287.

There are no other accessible administrators in the tenant.

I cannot access the Microsoft 365 Admin Center to create a support request. Azure technical support requires a paid support plan. I also called Microsoft support, but the automated phone system instructed me to forward a previous service email, which I do not have, and then disconnected the call.

This is not a password reset issue. I need assistance with a sole Global Administrator tenant lockout and escalation to the Data Protection / Tenant Recovery team so tenant ownership can be verified and the MFA/security information can be reset.

I can provide the Tenant ID, administrator UPN, request/correlation IDs, proof of access to the registered recovery methods and any other required information privately.

Answer 1

Hi @Niko,

The error code 399287 you’re encountering is most commonly related to Multi-Factor Authentication (MFA). In many cases, it appears when the phone number being used for verification has been flagged by Microsoft’s phone number reputation or risk-based protection systems.

As you mentioned, because you are the sole Global Administrator in the tenant, this situation requires assistance from the Data Protection Team, as they have the tools and verification processes necessary to validate tenant ownership and help restore administrator access when no other admin accounts are available.

I understand that your previous attempts to contact support have not been successful. However, as this is a user-to-user community forum, I do not have the ability to create support tickets or escalate cases on your behalf. I would recommend calling Microsoft Support again and using the following approach to help navigate the IVR (Interactive Voice Response) system more effectively:

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)      

In some regions, the initial interaction may be automated, so here’s a general idea of how the conversation might go to help you prepare:        

What kind of problem are you experiencing?           

Answer: Authenticator           

What products do you use?           

Answer: Office 365 for business           

Is this for an education or company account?           

Answer: For companies           

Are you an administrator?           

Answer: Yes           

Are there any other administrators in your organization?           

Answer: No. I am the only admin in my tenant            

Do you need a... Service request?            

Answer: Yes. I need to create a ticket. Please send me direct to the Data Protection Teams.        

During the phone call, you will need to provide the information associated with your subscription, such as your company name, billing details, phone number, and an alternate email address, etc. This information allows the Data Protection team to verify your identity and securely assist you in regaining access to your administrator account.       

If calling support hasn’t been effective so far, there is a workaround you might consider. You can create a new Microsoft 365 tenant by signing up for a trial subscription here: Microsoft 365 Business Plans and Pricing | Microsoft 365  

Once the new tenant is created, you’ll be able to sign in to the Microsoft 365 admin center and submit a support ticket from there. In your request, clearly explain that you need help with regaining access to an administrator account in your original tenant and ask to be routed to the Data Protection team. This approach typically ensures that the ticket is properly assigned and handled by a real support engineer rather than remaining stuck in automated flows or disconnected mid-process.   

Important notes:   

• This new trial tenant will not give you access to any of the data or settings in your original locked tenant. It is solely a temporary means to contact Microsoft support.  
• Be prepared for Microsoft support to ask for verification of your identity and administrative rights for the locked tenant.  
• Remember to cancel the trial subscription for the new tenant once your issue with the original account is resolved to avoid any unintended charges.  

I hope this information helps you reach the appropriate team and regain access to your tenant as quickly as possible.

Thank you so much for taking time.