Microsoft 365 Admin Lockout: Error Code 500121, no Global Administrator and MFA broken

Question

Issue summary

Our Microsoft 365 tenant is completely locked out due to an admin access issue.

• The tenant has only one admin account.
• That admin account is NOT a Global Administrator.
• Microsoft Authenticator MFA is broken:
  • Push notifications do not arrive.
  • OTP codes are not generated.
• We cannot access admin.microsoft.com or Microsoft Entra admin center.

This appears to be an Admin Lockout scenario.

---

Error details

• Error Code: 500121
• Request ID: [Moderator note: personal info removed]
• Correlation ID: [Moderator note: personal info removed]
• Timestamp: [Moderator note: personal info removed]

---

What we need

We need guidance or confirmation on the correct recovery process for this situation.

Specifically:

• How can Global Administrator access be restored when there is no existing Global Admin?
• Can Microsoft Support reset MFA or issue a Temporary Access Pass (TAP) in this case?
• What ownership verification documents are typically required?

---

Environment

• Product: Microsoft 365 (Business / Organization)
• Tenant: [Moderator note: personal info removed]
• Scenario: Admin Lockout due to MFA failure

Any official guidance or escalation path would be appreciated.

Answer 1

Note: I noticed that you’ve been using English, while your current site is set to ko-kr. In this case, I’ll follow the language you’ve been using (English) to keep things consistent. If anything seems unclear or you’d prefer to communicate in a different language, please let me know your preferred language. I’ll be happy to adjust accordingly.

(Let me hide the person's personal information in a private message, as this is personal information and should not be displayed in the community, it could affect your tenant. I hope you understand that.) 

Dear @마중물 사무국, 

Thank you for posting your question in the Microsoft Q&A forum.  

As a moderator, I don't have the tools to investigate your specific tenant directly. This is because Microsoft's data security protocols are very strict. However, I will guide you as clearly as possible so you can reach the specific team capable of reconfiguring your MFA. 

Based on the tenant information you provided, I’ve asked another team to check, and it appears that your tenant does have one Global Admin account, which is also the only admin account in the entire tenant. You mentioned that your admin account is not a Global Admin, so please help me double-check this with your team. Usually, when a subscription is purchased and a tenant is created, the person who sets it up is automatically assigned the Global Admin role. 

To sum up: I can confirm that this admin account is indeed the Global Admin for that tenant. Normally, a Global Admin would be the one to create a TAP (Temporary Access Pass) for others. However, since you are the only admin and you are currently locked out, the only way forward is to contact the Data Protection Team to reconfigure your MFA. 

I will now guide you on how to reach the Data Protection Team so they can help you reconfigure the MFA for your Global Admin account. 

Option 1: You might need to contact Data Protection Team via phone service number via this link: Customer service phone numbers - Microsoft Support. The agent will be able to create a ticket for you under the affected tenant and then transfer this ticket to Data Protection team who could help you to reconfigure your MFA.    

The biggest goal is to get past the IVR (automated system) to a live agent and emphasize this critically important security factor. Please try this script, speaking loudly, clearly, and patiently waiting for the machine to respond. First, when you call the hotline, they will ask you what kind of problem you are struggling with.  

Answer: Authenticator.  
A: What products do you use?  
B: Office 365 for business.  
Verification: Education or company account?  
B: For companies  
A: Are you an administrator?  
B: Yes.  
A: Are there any other administrators in your organization?  
B: No.  
A: I need one.... Service request?  
B: Yes  

Option 2: Create a new tenant with trial subscription to access and submit a ticket in Admin Center. 

If you still can't get through to a real person for help, help me try this: 

Register for a free trial (new tenant with trial subscription) of Microsoft 365 at this link: Compare All Microsoft 365 Plans | Microsoft. The goal is to create a temporary Global Admin account so you can log in to the Microsoft Admin Center. Once you're in, you can submit a support ticket directly to Microsoft. Please remember to cancel the trial subscription once your issue is resolved to avoid any unintended charges.   

How to Submit the Support Ticket in Admin Center: Get support - Microsoft 365 admin | Microsoft Learn 

Please review this email carefully and select the option that applies to your scenario. Should you have any questions or require further clarification, do not hesitate to reach out. 

Looking forward to your response!  

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.