Sole Global Administrator locked out by MFA (Error 500121) - Authenticator receives no approval request

Question

I am the sole Global Administrator of a paid Microsoft 365 Business tenant.

Issue:

• Error 500121 during sign-in
• The only MFA option offered is "Approve a request in Microsoft Authenticator"
• I still have the original phone with Microsoft Authenticator installed
• The work account is visible in Authenticator
• No approval request appears
• No number matching prompt appears
• No one-time code is available
• No alternate verification methods are offered
• No other Global Administrator exists

I am located in Thailand.

The support phone number listed on the Microsoft support site is not reachable.

I cannot open a support ticket because I cannot complete MFA.

I can provide proof of ownership, including:

• Tenant name
• Domain ownership verification
• Billing/subscription information

I am requesting escalation to the Data Protection / Tenant Recovery team for recovery of the sole Global Administrator account.

Answer 1

Hi @noktoom phongchotip,

Thank you for posting your question in the Microsoft Q&A forum.       

I’m very sorry to hear about your situation. Regarding that you’re unable to log in to your global admin account.  

If you don't have any other admin account in this situation, the Microsoft Data Protection team has tools and processes in place to verify identity and regain access to administrator accounts.     

Please note that I'm also a user so I don’t have access to user accounts and cannot assist with actions such as password resets, login changes, or account recovery. 

If you’re unable to reach the Data Protection team by phone, you can try setting up a new trial tenant or use your existing tenant to submit a support request.   

1. Visit the Microsoft 365 Enterprise Plans page: Go to Compare Office 365 Enterprise Pricing and Plans | Microsoft 365.   
2. Choose a plan and start a free trial: Select any of the available plans and click "Try for free" to begin the trial setup process.   
3. Follow the guided setup: Complete the steps to create a new Microsoft account and a new tenant. This will be a separate and independent Microsoft 365 environment.   
4. Access the Microsoft 365 Admin Center: Once the new tenant is created, navigate to https://admin.microsoft.com/.   
5. Go to Support: In the left-hand navigation menu, click on "Support" and then "Help & support."   
6. Raise a support ticket: Describe your issue in detail. Crucially, you must clearly state that you are locked out of a different, pre-existing Microsoft 365 tenant where you are the administrator. Provide the following information about your locked account:    
   • Your administrator account email address for the locked tenant.   
   • The domain name of your locked tenant    
   • Any error messages you are receiving.   
   • Details about the authentication issues you are experiencing.   
   • Confirmation that you are the administrator of the locked tenant.   
7. Submit your ticket: Follow the prompts to submit your support request. You will likely receive a ticket number for tracking.   

When you open a support ticket, please make sure to turn off the Support Assistant (AI) in the help panel.  

Several customers have reported issues when the Support Assistant is turned on  the system sometimes fails to display the “Contact Support” option.  

As shown in the screenshot, simply switch Support Assistant > Off, then type your issue description.  Once the AI is off, the “Contact Support” button will appear normally, allowing you to submit a ticket directly.  

Important notes:     

• This new trial tenant will not give you access to any of the data or settings in your original locked tenant. It is solely a temporary means to contact Microsoft support.    
• Be prepared for Microsoft support to ask for verification of your identity and administrative rights for the locked tenant.    
• The resolution time might be longer as you are contacting support from a different tenant.    
• Remember to cancel the trial subscription for the new tenant once your issue with the original account is resolved to avoid any unintended charges. You can typically do this within the Microsoft 365 Admin Center under "Billing" -> "Your products."    

Thank you again for your time and understanding. I really appreciate your patience, and I’m here to help. Looking forward to your response.   

---

If the answer is helpful, please click "Yes". If you have extra questions about this answer, please click "Comment".    

Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.