Sole Global Administrator locked out after phone replacement – MFA reset / Tenant Recovery required

Question

Sole Global Administrator locked out after phone replacement – MFA reset / Tenant Recovery required

Cristiano Correa 0

Hello,

I need assistance with a Microsoft 365 / Microsoft Entra tenant lockout and escalation to the Data Protection / Tenant Recovery team.

Situation

I am the owner and sole Global Administrator of a Microsoft 365 Business tenant.

Affected domain: pathdoc.app

Administrator account: [Moderator note: Personally Identifiable Information removed]@pathdoc.app

I recently replaced my mobile phone and no longer have access to the Microsoft Authenticator registration associated with the administrator account.

I know my username and password and my existing Outlook session is still working and I can send and receive email normally.

However, whenever I try to access the Microsoft 365 Admin Center, Microsoft Entra Admin Center, or Security Info, I am required to approve MFA using the Microsoft Authenticator registration from my previous phone.

The previous phone is no longer available.

I cannot register Microsoft Authenticator on the new phone because registering the new authentication method itself requires authentication using the previous MFA method.

There is no other Global Administrator in the tenant and I have no alternative MFA method available.

Therefore, I am completely locked out of all administrative functions.

Troubleshooting already performed

Tried accessing Microsoft 365 Admin Center — MFA required.

Tried accessing Microsoft Entra Admin Center — MFA required.

Tried accessing Security Info / My Sign-ins — MFA required.

Checked for alternative authentication methods — none available.

Previous Authenticator device is no longer available.

Contacted Microsoft telephone support, but I was unable to obtain effective assistance.

Tried creating a separate temporary Microsoft 365 tenant in order to open a support ticket, but the tenant creation process fails with an error.

The Microsoft 365 subscription was purchased directly from Microsoft; there is no CSP/reseller who can open a support request on my behalf.

Sign-in diagnostic information

Request ID: [Moderator note: Personally Identifiable Information removed]

Correlation ID: [Moderator note: Personally Identifiable Information removed]

Timestamp: 2026-09-04T17:51:31.052Z

This appears to be a sole Global Administrator tenant lockout.

I need Microsoft to perform the ownership verification process and reset/clear the MFA registration for the sole Global Administrator so that I can register Microsoft Authenticator again on my new device.

I can privately provide proof of ownership, including:

Control of the pathdoc.app domain and DNS;

Microsoft 365 subscription and billing information;

Company information and documentation;

Payment information;

Any DNS TXT verification requested by Microsoft;

Any other information required to establish ownership of the tenant.

Please escalate this case to Microsoft Support / Data Protection / Tenant Recovery.

I am happy to provide tenant-specific, billing, or ownership information through a private channel.

For security reasons, I will not post sensitive tenant, billing, or identity information publicly.

Thank you.

[Moderator note: Personally Identifiable Information removed]

0 comments

2 answers

Your answer

Answer 1

Cristiano Correa 0

Hi Teddie,Thank you for your response.

I would like to clarify an important point regarding my previous attempts to obtain assistance from Microsoft Support.

I was able to reach Microsoft Support by telephone, and a support case was created specifically for this MFA issue:

MFA Assistance Request - TrackingID#[Moderator note: Personally Identifiable Information removed]

Unfortunately, the telephone support experience has not resulted in a solution.

I have made multiple attempts to resolve the issue by phone. Calls have been disconnected, continuity between support interactions has been difficult, and the representatives I was able to reach have not been able to resolve or successfully escalate the tenant lockout.

As part of the existing support case, Microsoft asked me to add a specific verification value to the DNS records of my domain in order to demonstrate control/ownership of the domain. I completed that DNS verification as requested.

Despite completing this ownership verification step and having an existing Tracking ID, my MFA registration was not reset and I remain completely locked out of the Microsoft 365 and Microsoft Entra administration portals.

Therefore, this is not simply a case where I was unable to contact telephone support. I have already:

Contacted Microsoft Support by telephone multiple times;

Obtained an official support case and Tracking ID;

Worked with Microsoft representatives regarding the MFA problem;

Completed a DNS ownership verification requested by Microsoft;

Continued attempting to obtain assistance after the initial contacts.

Unfortunately, none of these interactions has resulted in restoration of administrative access.

My current situation remains:

I am the sole Global Administrator of the tenant;

I know the administrator username and password;
The previous phone containing Microsoft Authenticator is no longer available;

There is no alternative MFA method;

There is no second Global Administrator;

I cannot access Microsoft 365 Admin Center, Microsoft Entra Admin Center, or Security Info;

The Microsoft 365 subscription was purchased directly from Microsoft, so there is no CSP/reseller who can assist;

Microsoft has already requested and I have completed DNS verification of the domain;

The existing Microsoft support case has not restored administrative access.

Regarding the alternative of creating a temporary Microsoft 365 trial tenant, I also attempted that route. However, Microsoft's verification/challenge step fails with:

“Something went wrong. Please reload the challenge to try again.”

Reloading the challenge does not resolve the problem.

Interestingly, I encountered the same challenge error when attempting to post this question from my computer. I was only able to successfully post on Microsoft Q&A after switching to my mobile phone using a 5G connection.

At this point, I have exhausted the normal recovery channels available to me.

Given that an official Microsoft support case already exists under TrackingID#[Moderator note: Personally Identifiable Information removed], and that Microsoft has already asked me to perform domain ownership verification, could you please advise whether this case can be escalated internally to the Data Protection / Tenant Recovery team for review and completion of the MFA reset?

I can provide any additional tenant, billing, DNS, subscription, or ownership information required through a private channel.

I would greatly appreciate assistance in getting this case to the appropriate Microsoft team, as I currently have no administrative access to my own Microsoft 365 tenant despite having completed the ownership verification requested by Microsoft.

Thank you.

[Moderator note: Personally Identifiable Information removed]

Teddie Dang 1,460 Reputation points Independent Advisor

2026-09-05T03:03:51.5633333+00:00

Hi @Cristiano Correa

Thank you for your additional information.

I am a fellow user like you, and I do not have access to Microsoft's internal support system, so I cannot track your support ticket, view its status, or see which team is currently handling it.

If the support ticket has already been successfully created for this tenant recovery issue, I would recommend continuing with that existing case rather than creating another ticket.

The support agent should be able to route the case to the Data Protection team for the tenant recovery process. There is no need for you to escalate the case to the Data Protection team on your own. The support team can determine the appropriate escalation path internally. They may contact you to complete the necessary ownership verification, such as confirming control of the domain through DNS TXT verification and providing other required tenant or subscription information.

Since you mentioned that the agent has already verified your domain/ownership, the next step would generally be to wait for them to continue processing the existing case. These cases can sometimes take longer than a standard support request because additional ownership and security checks may be required and that team is always overwhelmed.

You can follow up through the confirmation email associated with your existing support case. You can reply directly to that email and include your support ticket number so the case remains connected to the same investigation, but avoid creating another ticket for the same issue, as it may be treated as a duplicate and could potentially delay the handling of the existing case.

At this point, since you already have an active support case and the ownership verification has been completed, I would suggest being patient and allowing Microsoft Support to proceed with the recovery process.
Cristiano Correa 0 Reputation points

2026-09-05T18:34:25.1033333+00:00
Hi Teddie,

Thank you. Your suggestion regarding the existing support case is very helpful, and I would like to provide some additional context because I have now reviewed the email history associated with TrackingID#[Moderator note: Personally Identifiable Information removed].

The case was handled by a Microsoft Customer Support representative named Francisco S.

On July 29, 2026, I received an email from Microsoft stating that they had been unable to reach me by telephone and that the service request would therefore be temporarily archived until I was available to continue working on the issue.

The important point is that the case was not closed because the MFA problem had been resolved. I remained locked out of the tenant.

I replied to that email the same day explaining that the telephone calls had occurred at times when I was unavailable and that the MFA issue remained unresolved.

As mentioned previously, during the support process I was also asked to perform a DNS verification through Cloudflare, which I completed as requested.

Unfortunately, the support process did not ultimately restore my administrative access.

I have also tried contacting Microsoft by telephone again. The experience has been extremely difficult: calls have been disconnected, continuity between representatives has been poor, and I have not been able to get the case successfully completed or escalated to the team capable of resolving the tenant lockout.

Yesterday, September 4, 2026, I replied again directly to the original Microsoft support email thread associated with the case, requesting urgent assistance and explaining that more than two months have passed since the original contact and that the problem remains unresolved.

Therefore, I have now followed exactly the approach you suggested: I contacted Microsoft again through the existing support case/email thread rather than opening a duplicate case.

The current situation is:

Existing Microsoft case: MFA Assistance Request – TrackingID#[Moderator note: Personally Identifiable Information removed].

Domain ownership/DNS verification requested by Microsoft: completed

Case temporarily archived because Microsoft was unable to reach me by phone: yes

Problem resolved: no

Administrative access restored: no

Follow-up sent directly to the existing Microsoft support email thread on September 4: yes

Response to that latest follow-up: not yet

Since the case was archived without the underlying MFA/tenant lockout being resolved, would the appropriate next step be to have TrackingID#[Moderator note: Personally Identifiable Information removed]. reactivated and escalated to the Data Protection / Tenant Recovery team?

If there is any way to help flag the existing case for escalation, I would greatly appreciate it.

Thank you again for your assistance.

[Moderator note: Personally Identifiable Information removed].
Teddie Dang 1,460 Reputation points Independent Advisor

2026-09-07T02:27:59.4933333+00:00
Hi @Cristiano Correa

Please check the email correspondence you previously received from the Microsoft support agent. In the signature section of the email, there may be contact information for the agent's manager. When you send your follow-up requesting that the archived case be reopened, you could CC the manager if their email address is provided in the signature.

After sending that follow-up, please wait for Microsoft Support to contact you back.

If you still cannot get the existing case reactivated, another option may be to create a new support ticket through a temporary trial tenant. Since you previously mentioned that you encountered an error when trying to create the trial tenant, you can:

Try a different web browser.

Try an InPrivate/Incognito browser session.

Try a different network, such as your mobile 5G connection instead of your normal Internet connection.

Try creating the trial tenant using your mobile phone rather than the computer.

If you are able to create the trial tenant successfully and open a new support case, make sure to provide the previous ticket number and explain that the new case is a continuation of the previous unresolved sole Global Administrator/MFA recovery issue. This will allow the new support agent to understand the history and avoid starting the investigation from scratch.

That's all the options I can suggest from this forum side. I hope this helps, and I hope Microsoft can get your administrative access restored soon.
Cristiano Correa 0 Reputation points

2026-09-07T16:09:35.4166667+00:00

Hi Teddie,

I reviewed the complete email history from Microsoft Support and found some additional details that may be relevant.

There is no manager or supervisor contact information in any of the emails from Francisco S. His signature only identifies him as Microsoft Customer Support and uses the generic [Moderator note: Personally Identifiable Information removed]@techsupport.microsoft.com address.

I also confirmed that there were actually two support cases.

The first case, [Moderator note: Personally Identifiable Information removed], was opened under the wrong account/registration. Microsoft later informed me that the correct case for the pathdoc.app tenant was [Moderator note: Personally Identifiable Information removed].

The correct case was classified by Microsoft as:

Microsoft 365 / Customer Protection / MFA

There is also an email from Microsoft referring to their Microsoft 365 data protection support and instructing me to continue under case [Moderator note: Personally Identifiable Information removed].

Regarding the DNS verification, Microsoft asked me on July 24 to add a TXT record to pathdoc.app. I added the requested record the same day and notified support.

However, Microsoft sent essentially the same DNS request again on July 27 and July 28. On July 29 I replied again explaining that the TXT record had already been added the previous week.

I cannot find any email confirming that Microsoft actually completed the DNS validation, despite my having added the requested record and notified them.

On July 29 the case was temporarily archived because Microsoft was unable to reach me by phone, not because the MFA issue had been resolved.

Microsoft explicitly instructed me to reply to the same email thread if I still needed assistance. I did exactly that again on September 4, but I have not yet received a response.

So at this point:

there is no manager contact available in the support emails;

the existing case is already under Customer Protection / MFA;

I complied with the requested DNS TXT step;

the case was archived without solving the MFA lockout;

and I have already replied to the original support thread requesting reactivation.

Would you recommend that the appropriate next step now is to have case [Moderator note: Personally Identifiable Information removed] reactivated and completed by the Customer Protection / Data Protection team, rather than opening another case?

Thank you again.

[Moderator note: Personally Identifiable Information removed].
Teddie Dang 1,460 Reputation points Independent Advisor

2026-09-08T00:27:34.16+00:00

Hi @Cristiano Correa

Please stop mentioning the support case number in this public forum. The case number is specific to your support request and should not be shared publicly.

As I mentioned earlier, I am just a fellow user like you and do not have access to Microsoft's internal support system, so I cannot check, track, reactivate, or escalate your support case. I can only offer suggestions based on the information you provide.

If you are unable to get the existing case reactivated, you may need to create a new support case and provide Microsoft Support with the relevant history.

If creating a temporary trial tenant as suggested earlier does not work, you can also review the ultimate solution in this thread SOLUÇÃO DEFINITIVA: Como recuperei o acesso ao meu Tenant (Admin Global) bloqueado no looping do MF…

Please note that this post is not in English, so you may need to use your browser's translation feature or another translation tool if needed.

I have shared all the options I can suggest from the community side. I hope Microsoft Support is able to take over and resolve the tenant recovery issue for you.
Cristiano Correa 0 Reputation points

2026-09-08T01:45:09.2633333+00:00

Hi Teddie,

Thank you for your help.

I was finally able to create a temporary Microsoft 365 tenant and open a new support request. However, the process still ends in the same place: escalation to the Data Protection team, largely through telephone support.

I want to leave a very clear record of my dissatisfaction.

It is unacceptable that a business customer can remain locked out of the administrative environment for months because of an MFA issue, even while still controlling the mailbox, domain, DNS, billing information and all other elements necessary to prove ownership.

The recovery process has been fragmented, slow and overly dependent on telephone calls. In 2026, it is difficult to justify that a critical identity and business continuity issue cannot be resolved through a secure, structured and fully digital recovery process.

The same applies to Microsoft Q&A. It can provide guidance, but if it cannot escalate, reactivate or materially move a critical recovery case forward, its practical value in situations like this is very limited.

This experience has seriously reduced my confidence in Microsoft 365. I am now considering moving my company to another provider, because it is not reasonable to depend on a platform where a critical administrative lockout can remain unresolved for months.

Thank you again for your assistance.
Teddie Dang 1,460 Reputation points Independent Advisor

2026-09-08T02:03:08.52+00:00

Hi @Cristiano Correa

Regarding the concerns you raised about the recovery process and Microsoft Q&A, I understand the point you are making.

Just to clarify the role of this forum, Microsoft Q&A is a user-to-user support community. We are fellow users sharing troubleshooting steps, possible solutions, and experiences that may help resolve an issue. When an issue cannot be resolved through community troubleshooting, the next step is to contact the relevant Microsoft support team that has access to the required internal systems.

For this particular situation, the Data Protection team is the only team that handles this type of sole Global Administrator/tenant recovery case. Therefore, the purpose of contacting Microsoft Support is to have the case transferred/escalated to that team.

I understand that the process has been frustrating, but from the community side, I have shared the troubleshooting and support options available to me. I hope the Data Protection team is able to complete the verification and restore your administrative access this time.

Answer 2

Hi @Cristiano Correa

It sounds like you have already tried the two common approaches typically suggested in the community for a sole Global Administrator locked-out tenant scenario.

Could you please clarify the following?

1.When you contacted Microsoft Support by phone, were you unable to obtain effective assistance from the support representative, or were you unable to get past the automated/AI system to reach the appropriate support team?

If you were unable to get past the AI, you could try using the following script:

Q. Can you tell me if you are calling as a home user who uses a product or service at home or a business user who uses it in your business to provide the best assistance? 
A.I am a business user. 
Q. Thank you. Can you give me the details of your inquiry? 
A. Login technical support. 
Q. First of all, can you tell me which products you are inquiring about today? 
A. Microsoft 365 business Standard。 
Q. Please wait a moment, I understand Microsoft 365. Are you calling about a new case or an existing one? 
A. New. 
Q. To receive phone support, your phone number must be associated with your Microsoft 365 admin profile. To do this, go to aka.ms/m365profile. Again, it aka.ms/m365profile . This can take 48 hours. In the meantime, you can go to aka.ms/m365profile and file a case online. If you prefer, you can also text the link to the phone number you are calling. What do you think? 
A. The phone number is already linked to the link. 
Q. Can you tell me about the products in your inquiry? 
A. Microsoft 365 Business Standard. 
Q. Are you a Global Administrator? 
A. That's right. 
Q. I'm sorry. I didn't understand. Are you a global administrator for your domain? 
A. Yes, I am a global administrator for the domain. 
Q. If you have any inquiries, you can contact a Microsoft representative. Are you sure? 
A. Yes. Please. 
Q. Yes, I understand. Please wait a moment.

2.Regarding the temporary trial tenant you attempted to create in order to raise a support ticket, could you please provide the exact error message you received during the tenant creation process? If possible, please provide the complete error message or a screenshot.