Microsoft 365 Global Administrator locked out with Error 500121 during MFA

Question

I am the sole Global Administrator for our Microsoft 365 tenant, and I am currently unable to sign in to the Microsoft 365 admin portal because the authentication process fails during MFA.

The sign-in displays the following error:

• Error Code: 500121
• Request ID: [Moderator note: personal identifiable Information removed]
• Correlation ID: [Moderator note: personal identifiable Information removed]
• Timestamp: 2026-09-23T11:36:45Z
• Account: Global Administrator account
• Administrator situation: I am currently the only Global Administrator for the tenant
• Service: Microsoft 365 / Microsoft Entra ID
• Issue: Unable to complete the MFA authentication step and therefore unable to access the Microsoft 365 admin center

Tenant and verification information

I can provide the following information privately to Microsoft Support if required:

• Microsoft 365 tenant name/domain
• *.onmicrosoft.com tenant domain
• Organization/company details
• Previous Billing

I do not want to post sensitive information publicly, such as passwords, MFA verification codes, recovery codes, payment card details, or security-question answers.

Assistance requested

Could someone advise on the correct Microsoft-supported recovery procedure for a sole Global Administrator who is locked out because of an MFA error (500121)?

Specifically:

1. Is there a supported way to reset or re-register MFA for the sole Global Administrator without another Global Administrator account?
2. Should I contact Microsoft Support and request tenant/Global Administrator account recovery or Data Protection assistance?
3. What verification information will Microsoft require to establish tenant ownership?
4. Can Microsoft provide a temporary recovery method or reset the administrator's authentication methods after ownership has been verified?
5. Are there any additional steps I should take before opening a support request to avoid making the situation worse?

I can provide the tenant ID, domain information, and other ownership-verification details directly to Microsoft Support through a secure channel.

Answer 1

Good day Ronald and I’m sorry to hear that you are unable to access your Microsoft 365 tenant, especially because you are currently the only Global Administrator. 

Just to gently clarify before going any further, this forum is separate from Microsoft Support. I don’t have the ability to access or investigate individual accounts because this is a user‑to‑user support forum. 

The Error 500121 message indicates that the required MFA verification wasn't completed successfully. This can happen when the verification request expires, the approval or verification code fails, or the existing authentication method is no longer valid. 

Regarding your questions, Vinay Menon's reply is correct and covers the main points well. Before contacting Microsoft Support, please keep the error details and your tenant information readily available for verification purposes. For your security, don't share passwords, MFA verification codes, recovery codes, or payment information in public forums. As it doesn't include detailed guidance for contacting Microsoft Support when the only administrator cannot access the account, please follow the steps below: 

Since there are no other admins available to reset MFA, identity verification and account recovery can only be handled by the Microsoft Data Protection team, which is authorized to help restore access to your admin account. Please try locating the appropriate hotline for your region here: Customer service phone numbers - Microsoft Support  

When contacting Microsoft, be prepared to verify your subscription ownership by providing details such as your organization name, billing or payment information, registered phone number and alternate email address. 

Once your identity is verified, the privacy team will be able to reset your MFA settings. You can then reset your account in the Microsoft Authenticator app using your phone number or choose a different authentication method to sign in. 

Tips for navigating the IVR:  

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)    

In some countries, an automated voice system is used. Example of a dialogue: 

IVR: What problem is bothering you? 

Client: Lost access to the only admin account. 

IVR: What product do you use? 

Customer: Office 365 for business. 

IVR: School or Business Account? 

Client: Companies. 

IVR: Are you an administrator? 

Client: Yes. 

IVR: Is there another administrator in your organization? 

Client: No. I am the only admin in my tenant.     

IVR: Do you need to create a support ticket? 

Client: Yes. I need to create a ticket. Please send me direct to the Data Protection team. 

In case you are unable to contact the frontline support: 

Consider signing up for a trial subscription to create a new tenant. Visit Microsoft 365 Business Plans and Pricing | Microsoft 365. 

Once the new tenant is set up, you can access its admin center and submit a support ticket through Microsoft 365 admin center > Support > Help & Support to contact the Data Protection team regarding the previous tenant. Please remember to cancel the trial subscription after your issue is resolved, as this will help you avoid any accidental billing. You may prefer the following resource for detailed instructions: Cancel your Microsoft business subscription in the Microsoft 365 admin center | Microsoft Learn 

If your organization's subscription is from a partner or reseller: Contact the reseller's support provider to help open a service request on behalf of you instead. 

I hope this helps point you in the right direction. If you have any questions, please don’t hesitate to reach out at any time. 

---

If you have any extra questions about this answer, please click "Comment".            

Answer 2

1. No self-service reset is possible if you are the sole Global Administrator and locked out of MFA.
   • Normally, another Global Admin could reset your MFA, but in this case, Microsoft Support must step in.
2. Contact Microsoft Support:
   • Open a support request via the Microsoft 365 Admin Center (if possible from another account with limited access) or call Microsoft Support directly.
   • Global Admin recovery falls under Data Protection / Account Recovery.
3. Verification Information Required: Microsoft Support will ask for proof of tenant ownership. Typically, this includes:
   • Tenant name and domain (e.g., *.onmicrosoft.com)
   • Organization/company details (legal entity name, address, contact info)
   • Previous billing information (invoice numbers, last 4 digits of payment card, billing contact email)
   • Tenant ID (GUID) if available
   • Any other verifiable details tied to your subscription
   NOTE: They will never ask for passwords, MFA codes, or recovery codes directly.
4. Temporary Recovery Method:
   • Once ownership is verified, Microsoft can reset or remove the MFA requirement for the locked-out Global Admin account.
   • You will then be able to sign in and re-register MFA methods.