Sole Global Admin Locked Out After Losing MFA Device – Need Tenant Recovery Guidance

Question

Hi Team,

I am currently locked out of my Microsoft 365 tenant and would appreciate guidance on the recovery process.

Scenario:

• I am the sole Global Administrator of the tenant.

MFA was configured using Microsoft Authenticator on my previous mobile device.

The device has been lost and is no longer accessible.

No alternate MFA methods (SMS, phone call, backup authenticator, recovery code, etc.) were configured.

I know the Global Admin username and password.

The tenant has a verified custom domain, and I have full access to the domain's DNS management.

I can provide billing/subscription details and proof of domain ownership if required.

Questions:

What is the recommended recovery process for a sole Global Admin locked out due to a lost MFA device?

Can Microsoft verify ownership through DNS records and reset MFA registration?

Which team should I contact (Data Protection Team, Tenant Recovery Team, or Microsoft 365 Support)?

What documents or information should I prepare to expedite the recovery?

Any guidance from Microsoft moderators or users who have successfully recovered access in a similar situation would be greatly appreciated.

Thank you.Hi Team,

I am currently locked out of my Microsoft 365 tenant and would appreciate guidance on the recovery process.

Scenario:

I am the sole Global Administrator of the tenant.

MFA was configured using Microsoft Authenticator on my previous mobile device.

The device has been lost and is no longer accessible.

No alternate MFA methods (SMS, phone call, backup authenticator, recovery code, etc.) were configured.

I know the Global Admin username and password.

The tenant has a verified custom domain, and I have full access to the domain's DNS management.

I can provide billing/subscription details and proof of domain ownership if required.

Questions:

What is the recommended recovery process for a sole Global Admin locked out due to a lost MFA device?

Can Microsoft verify ownership through DNS records and reset MFA registration?

Which team should I contact (Data Protection Team, Tenant Recovery Team, or Microsoft 365 Support)?

What documents or information should I prepare to expedite the recovery?

Any guidance from Microsoft moderators or users who have successfully recovered access in a similar situation would be greatly appreciated.

Thank you.

Answer 1

Hi @Preetam Rane,

Based on the scenario you described, the official recovery process is to contact Microsoft Support by phone so that the frontline support team can create a support case and route it to the Data Protection Team for further verification and assistance.

You can find the correct phone number for your region here: Contact Microsoft customer support

In this situation, the Microsoft Data Protection team has tools and processes in place to verify identity and regain access to administrator accounts.

Here are some tips and an example of a prompt to help you navigate the IVR more effectively:  

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)    

In some regions, the initial interaction may be automated, so here’s a general idea of how the conversation might go to help you prepare:      

• What kind of problem are you experiencing?         
• Answer: Authenticator         
• What products do you use?         
• Answer: Office 365 for business         
• Is this for an education or company account?         
• Answer: For companies         
• Are you an administrator?         
• Answer: Yes         
• Are there any other administrators in your organization?         
• Answer: No. I am the only admin in my tenant          
• Do you need a... Service request?          
• Answer: Yes. I need to create a ticket. Please send me direct to the Data Protection Teams.      

During the phone call, you will need to provide the information you have received through your subscription, such as: Your company name, billing information, phone number, alternate email address, etc. Therefore, the privacy team can help you reset your multi-factor authentication, and after the reset, you can add your account back to your authenticator app on your phone and set it up from scratch or choose a different authentication method to log in to your account.    

I hope this information helps point you in the right direction and that you're able to regain access to your tenant soon. Once access has been restored, I would strongly recommend configuring at least one additional MFA method and maintaining a second Global Administrator account to help prevent similar situations in the future.

Thank you so much for taking the time.