Tenant Lockout - Only Global Administrator Lost MFA Access

Question

Hello Microsoft Support,

I am completely locked out of my Microsoft Entra ID (Azure AD) tenant.

I am the Global Administrator of the tenant. The Microsoft Authenticator application logged me out and I no longer have access to the MFA method required for sign-in.

Details:

• I am the only person managing this tenant.
• I have access to the administrator email address and can receive email verification codes.
• The sign-in process accepts the email verification code.
• After that it requires Microsoft Authenticator approval.
• The Authenticator account is no longer available on my device.
• The second Global Administrator account also belongs to me and is affected by the same MFA issue.
• Currently there is no Global Administrator able to reset MFA methods.

I have already tried:

• Self-service account recovery.
• aka.ms/ProSupport.
• Microsoft support phone numbers.

Please escalate this case to the Data Protection Team for tenant ownership verification and MFA reset.

I can provide tenant information, subscription information, billing information, and domain ownership verification if required.

Thank you.

Answer 1

Hi @Pavel Vorobev,

Based on your description, I agree that this appears to be a situation that requires assistance from the Microsoft Data Protection Team, as that team has the tools and processes in place to verify tenant ownership and help restore access to administrator accounts when no Global Administrator is able to sign in.

However, because this is a user-to-user community forum, the people responding here are not part of Microsoft's internal support organization and do not have the ability to create, transfer, or escalate cases on your behalf.

I noticed that you mentioned you have already tried Microsoft's support phone numbers. Were you able to successfully create a support ticket, or were you unable to get through to a support engineer?

If you were unable to create a ticket because the call kept getting routed through automated options, you may want to try calling again and using the following approach:

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)    

In some regions, the initial interaction may be automated, so here’s a general idea of how the conversation might go to help you prepare:      

• What kind of problem are you experiencing?         
• Answer: Authenticator         
• What products do you use?         
• Answer: Office 365 for business         
• Is this for an education or company account?         
• Answer: For companies         
• Are you an administrator?         
• Answer: Yes         
• Are there any other administrators in your organization?         
• Answer: No. I am the only admin in my tenant          
• Do you need a... Service request?          
• Answer: Yes. I need to create a ticket. Please send me direct to the Data Protection Teams.      

During the phone call, you will need to provide the information associated with your subscription, such as your company name, billing details, phone number, and an alternate email address, etc. This information allows the Data Protection team to verify your identity and securely assist you in regaining access to your administrator account.     

If calling support hasn’t been effective so far, there is a workaround you might consider. You can create a new Microsoft 365 tenant by signing up for a trial subscription here: Microsoft 365 Business Plans and Pricing | Microsoft 365  

Once the new tenant is created, you’ll be able to sign in to the Microsoft 365 admin center and submit a support ticket from there. In your request, clearly explain that you need help with regaining access to an administrator account in your original tenant and ask to be routed to the Data Protection team. This approach typically ensures that the ticket is properly assigned and handled by a real support engineer rather than remaining stuck in automated flows or disconnected mid-process.   

Note: Please remember to cancel the trial subscription once your issue is resolved to avoid any unintended charges.

If you have not yet been able to open a case with the Data Protection Team, I would suggest trying the steps above. If there are any updates, or if there is anything in the process that you'd like to clarify further, please feel free to reply and I'll do my best to help.

Thank you, and I sincerely hope you're able to regain access to your tenant soon.