Locked out MFA loop

Question

Locked out MFA loop

TaraNielsen-1852 0

Need help - locked out as administrator - looping due to authenticator not set up on new phone

Emily T 820 Reputation points Microsoft External Staff Moderator

2026-10-12T17:04:47.2333333+00:00
Hi @TaraNielsen-1852
I hope you're doing well.

Based on what you've described, the next steps will depend on whether there are other administrators in your organization who can access the tenant.

If another administrator is available, I'd recommend contacting them and asking if they can reset the MFA settings for the affected account through the Microsoft Entra admin center. This is usually the quickest way to regain access.

For reference: Manage authentication methods for Microsoft Entra multifactor authentication - Microsoft Entra ID | …

If you're the only administrator and you've been locked out of the account, you'll need to contact Microsoft's Data Protection team for assistance. They are the only team authorized to help recover access in situations involving the sole administrator account.

You can find Microsoft's support numbers here: Contact Microsoft customer support | Microsoft Support

When contacting Microsoft, be prepared to verify ownership of the subscription. You may be asked for information such as:

Organization name

Billing or payment information

Registered phone number

Alternate email address

Once your identity is verified, the privacy team will be able to reset your MFA settings. You can then reset your account in the Microsoft Authenticator app on your new device or choose a different authentication method to sign in.

Tips for navigating the IVR:

In some countries, an automated voice system is used. Example of a dialogue:

IVR: What problem is bothering you?

Client: Lost access to the only admin account

IVR: What product do you use?

Customer: Office 365 for business

IVR: School or Business Account?

Client: Companies

IVR: Are you an administrator?

Client: Yes

IVR: Is there another administrator in your organization?

Client: No. I am the only admin in my tenant

IVR: Do you need to create a support ticket?

Client: Yes. I need to create a ticket. Please send me direct to the Data Protection Teams.

I also recommend calling during business hours. In my experience, it can be difficult to get through to the correct support queue, and automated systems don't always work as expected. If you can't get through on your first try, I suggest trying again later or at a different time.

In case you are unable to contact the frontline support:

Consider signing up for a trial subscription to create a new tenant. Once set up, you can access the new tenant's admin console and submit a support ticket to speak with the data protection team on behalf of the previous tenant. Once your issue is resolved, please remember to cancel the trial subscription to avoid any unintended charges.

If your organization's subscription is from a partner or reseller: Contact the reseller's support provider to help open a service request on behalf of you instead.

I hope this helps point you in the right direction. If you have any updates or additional questions, feel free to reply back and I'll do my best to assist further.

Best regards,

1 answer

Your answer

Answer 1

Have another administrator require MFA re-registration for your account; if no other administrator or emergency account can sign in, contact Microsoft Support for tenant-lockout recovery.

1. Try any previously registered alternative method

At the MFA prompt, select Sign in another way or Other verification options. Use a registered SMS, voice-call, security-key, passkey, or other available method.

If no alternative appears, proceed to the administrator reset. Installing Authenticator on the new phone alone does not transfer a usable work-account registration: backup and restore transfers only the account name for work or school accounts, after which sign-in and setup are still required.^1^

2. Have another administrator reset your MFA registration

Another administrator with at least the Authentication Administrator role should:

Sign in to the Microsoft Entra admin center.
Go to Entra ID → Users.
Select your administrator account.
Select Authentication methods.
Select Require re-register MFA, then confirm.
Optionally select Revoke sessions to invalidate existing refresh tokens.

Require re-register MFA removes the account’s registered phone numbers, Authenticator registrations, and software OATH tokens. At the next sign-in, you will be prompted to register a new method on the new phone.^2^

After the reset:

Sign in to an Office or Entra service with your password.
Follow the More information required prompt.
Install/open Microsoft Authenticator on the new phone.
Add the work or school account and scan the QR code displayed during registration.
Complete the test approval before removing any remaining working method.

3. If you are the only accessible administrator

This is a tenant lockout and cannot be fixed from the new Authenticator installation. Open a case with Microsoft Support and state:

The only accessible Global Administrator is locked out after changing phones, no registered MFA method is available, and tenant-access recovery is required.

When portal access is unavailable, use Microsoft’s customer-service phone numbers to open the case. Microsoft uses a high-assurance verification process to validate tenant ownership and then helps a designated Global Administrator regain access to the existing tenant.^3^ The country/region support numbers are listed here.^4^

Have these details available for ownership verification:

Tenant’s organization and domain names
Locked administrator sign-in name
Subscription and billing information
Registered business contact details
An alternate email address and phone number where support can reach you

If your organization has a Microsoft partner with active GDAP and appropriate administrative roles, that partner may also be able to restore access or create a support request on your behalf.^5^

After access is restored

Create and securely maintain at least two emergency-access (“break-glass”) accounts so loss of one phone or authentication method does not lock out the tenant again. Microsoft recommends two or more emergency-access accounts for this scenario.^6^

References