Sole Global Administrator locked out due to MFA after phone replacement

Question

Hello,

 

I am the sole Global Administrator of a Microsoft 365 tenant.

 

I know the administrator username and password, but I lost access to the Microsoft Authenticator app after replacing my mobile phone. The old device is no longer available, so I cannot complete MFA verification.

 

There are no other Global Administrators in the tenant who can reset my authentication methods.

 

The tenant is associated with a custom domain that I own, and I can provide proof of domain ownership, billing information, subscription details, and company information if required.

 

I am therefore completely locked out of the tenant and unable to access the Microsoft 365 Admin Center or Microsoft Entra Admin Center.

 

Could you please advise how I can initiate a Tenant Lockout Recovery request and get my MFA methods reset by the Data Protection / Tenant Recovery team?

 

Thank you for your assistance.

Answer 1

Dear @TamasP

I'm very sorry this happened to you. Unfortunately, I’m not able to forward this case directly to the Data Protection team, but you can contact them yourself. Before doing so, however, Please checking that the administrator account doesn’t have any other authentication methods configured besides the Authenticator app (SMS, Email, etc..).

You can start here:

https://support.microsoft.com/en-us/support/

In other countries, the call may be handled by an automated conversation. For example:

1. What kind of problem are you concerned about?
   1. Authenticator
2. What kind of product are you using?
   1. Office 365 for business/Azure portal/Entra ID
3. Is this an education or company account?
   1. Company
4. Are you an administrator?
   1. Yes
5. Do you have another administrator in your organization?
   1. No
6. You need to create a service request
   1. Yes

Once you reach a support engineer, I would be very explicit:

“This is a Microsoft Entra tenant lockout. The only Global Administrator account is no longer accessible, and there are no other Global Administrators in the tenant. We need to recover administrative access to the tenant. Please escalate this case to the Data Protection / Tenant Recovery team.”

Have the following information ready for the ownership verification:

• Tenant ID
• Initial *.onmicrosoft.com domain
• Custom domain name (If you have)
• Proof of domain ownership / DNS access
• Microsoft 365 subscription and billing information
• Company information
• Details about the previous Global Administrator
• Any other information Microsoft requests to verify ownership

For future protection, I would also recommend having at least two Break Glass account with Global Administrator permission. Full documentation for Break Glass accounts: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access

I hope this helps.

Best regards,

Bence