Entra Microsoft MFA

Question

I cannot use my authenticator anymore as a global admin. Need a tenant MFA recovery but Microsoft support is not responding. I am waiting for two days now without having my business email account.

Answer 1

Hi @danny sanderse

Could you please confirm whether this issue started after changing or replacing your device?

If so, you could try accessing MFA from the old device to see if the Microsoft Authenticator app is still working there.

In addition, if there is another administrator in the tenant, you could ask them to revoke or reset the MFA methods associated with your account.

You can refer via: Manage user authentication methods for Microsoft Entra multifactor authentication

If the above options do not help and there are no other administrators in the tenant, the official path to regain access is to contact Microsoft Support by phone for tenant recovery assistance.

Since you mentioned that Microsoft Support has not responded for the past two days, could you confirm whether you have already tried contacting Microsoft through the regional support phone number, or whether you have been able to reach the Data Protection Team and currently have an active tenant recovery case with Microsoft?

If you have not yet contacted Microsoft by phone, I would recommend doing so, as it is often the fastest way to escalate tenant lockout scenarios. You can find the support phone number for your region here: Contact Microsoft Support

When calling the support number, you may first hear a recorded message lasting approximately 30 seconds (for example, suggesting that you visit an online support page). You can simply wait for the menu options to be presented. Typically, selecting "1" for business users and then "1" again for technical support will guide you to the appropriate support flow.

In some regions, the initial interaction may be handled entirely by an automated system. To help you prepare, below is an example of the questions you may receive and the recommended responses:

What kind of problem are you experiencing?

Answer: Authenticator

What product are you using?

Answer: Office 365 for Business

Is this a school or work account?

Answer: Work account (or Corporate)

Are you an administrator?

Answer: Yes

Are there any other administrators in your organization?

Answer: No. I am the only administrator in the tenant.

Do you need a Service Request?

Answer: Yes. I need to open a support ticket. Please transfer me to the Data Protection team.

I hope this information helps you successfully escalate your request and regain access to your tenant. If you have any updates or additional questions, please feel free to reply to this thread. I will be happy to continue assisting you.

Warm thanks.

Answer 2

Updated todo list

Hi Danny

Losing the only Global Admin's MFA method and getting stuck waiting on support is a rough spot, but there are a few self-service paths depending on what you still have access to.

If you have a second Global Admin account (even one nobody normally uses), sign in with that and go to the Microsoft Entra admin center > Users > find your locked account > Authentication methods > Reset or remove the old authenticator, then register a new one. This is by far the fastest fix if it's available to you.

If you're truly the sole Global Admin with no other privileged account and no working MFA method at all, check whether your tenant has a break-glass emergency access account set up — these are meant to be excluded from MFA/Conditional Access for exactly this scenario. If one exists, sign in with it and fix the authentication method on your regular admin account from there.

If neither of those exist, you'll need Microsoft's Global Admin recovery process, which does require proof of ownership of the tenant (domain verification, billing info, etc.) — this only goes through support, so unfortunately there's no way around the wait for that specific path. To speed it up: make sure you opened the case as a "Sign-in" or "User and licensing management" issue under Entra ID in the admin center rather than a general request, mark it as Severity A / business-critical since you have zero admin access, and if you have a Premier/Unified support contract, call the phone line directly rather than only using the web ticket — phone escalations for full admin lockout usually move much faster than portal tickets.

For next time: setting up a proper break-glass account (cloud-only, excluded from all Conditional Access, strong password, monitored) is the standard fix so this can never happen again.

Let me know which of these applies to your situation and I can narrow it down further.