Sole Global Administrator locked out of Microsoft Entra tenant due to lost Authenticator MFA

Question

Sole Global Administrator locked out of Microsoft Entra tenant. The only registered Microsoft Authenticator device is permanently unavailable due to a hardware failure. Existing sessions were revoked, and sign-in now requires Authenticator approval or verification code. There is no alternative MFA method and no other Global Administrator available to reset MFA. I need assistance with tenant recovery and re-registering MFA on a new device.

Answer 1

Hi,

Via https://yourwindowsguide.com/2026/03/how-to-reset-microsoft-mfa.html

Get the Country Support phone number

First step you would need to do is to get the contact number for the country, using this Microsoft support document.

Customer service phone numbers – Microsoft Support

Once you have done that, call the number. See the extensive details on how to reach a Human:

Navigating the Support IVR — Step-by-Step

When you call Microsoft support to reset Microsoft MFA or resolve a forgot password for a Microsoft 365 issue, follow these IVR prompts:

• Wait out the intro — You may hear a ~30-second automated introduction (e.g., “you can visit the link…”). Ignore it and wait for the menu options.
• Press 1 — Select yourself as a business email user
• Press 1 again — Choose technical help

---

Automated IVR Conversation Guide

In some regions, the initial interaction is fully automated. Use these answers to navigate it:

• “What kind of problem are you experiencing?” → Answer: Authenticator
• “What products do you use?” → Answer: Office 365 for Business
• “Is this for an education or company account?” → Answer: For companies
• “Are you an administrator?” → Answer: Yes
• “Are there any other administrators in your organisation?” → Answer: No — I am the only admin in my tenant
• “Do you need a service request?” → Answer: Yes. I need to create a ticket. Please send me directly to the Data Protection Team.

To verify your identity and regain access to your Microsoft 365 administrator account, the Data Protection Team will need:

• ✅ Company name
• ✅ Billing details linked to your subscription
• ✅ Phone number on file
• ✅ An alternate email address
• ✅ Any other details associated with your Microsoft 365 account.

These steps can help you get access to your Microsoft 365 Business account.

Answer 2

Hello Janarthanan,

This is a tenant lockout scenario rather than a normal Authenticator re-registration issue.

Because you are the sole Global Administrator, the only registered MFA method is the unavailable Authenticator device, and there is no other Global Administrator who can reset the authentication methods, the normal self-service MFA reset options are not available.

Microsoft has handled similar sole-Global-Administrator lockouts through its specialized Data Protection/Tenant Recovery process. Recent Microsoft Q&A cases indicate that a support ticket can be escalated to that team so that tenant ownership can be verified and administrator access/MFA can be restored.

I recommend:

Contact Microsoft Support through an available non-admin route and explicitly describe the situation as a Microsoft Entra tenant lockout / sole Global Administrator unable to complete MFA.

Request escalation to the appropriate tenant recovery/Data Protection team.

Be prepared to provide tenant ownership information requested by Microsoft, such as the tenant/domain details, subscription or billing information, and other verification requested during the recovery process.

Do not create another Global Administrator or attempt to modify MFA through unofficial methods. Only Microsoft can perform the required administrative recovery when no administrator remains able to authenticate.

Once access is restored, register a new MFA method and create at least two cloud-only emergency access ("break-glass") accounts. Microsoft specifically recommends maintaining two or more emergency access accounts to prevent a future situation where all administrators are locked out.

Do not post the tenant ID, administrator email address, recovery information, or billing details publicly in this Q&A thread. Provide those details only through Microsoft's private support/recovery process.