Microsoft 365 Tenant Lockout – Sole Global Administrator – MFA Recovery Required

Microsoft business support must open a tenant-lockout case and route it to the Data Protection/Tenant Recovery team because no other administrator or registered authentication method is available to reset MFA.

Request the correct escalation by phone

Since the earlier telephone attempt did not reach an agent, call the business-support number for your country or region from Microsoft’s official directory ^1^.

Navigate the automated system with these answers:

1. Product: Office 365 for business
2. Issue: Authenticator or sign-in
3. Account type: Company/business account
4. Are you an administrator? Yes
5. Is another administrator available? No, sole Global Administrator
6. Do you need a service request? Yes
7. State:

   “This is a complete tenant lockout. I am the sole Global Administrator, the registered MFA device was stolen, and no alternative authentication methods exist. Please create a service request and route it to the Data Protection or Tenant Recovery team.”

This is the recovery path identified for the same sole-administrator/lost-device scenario ^2^.

Ask for and record:

• The service-request number
• The assigned support team
• The alternate email address where updates will be sent
• Any ownership-verification instructions

Prepare ownership evidence

Have the following available, but provide it only through the secure channel specified by Microsoft Support:

• Initial and custom tenant domains
• Company/legal name and contact details associated with the subscription
• Subscription and billing information
• Recent invoice and payment details
• An alternate reachable email address and telephone number
• Ability to create a requested DNS TXT record
• Approximate tenant creation or subscription-purchase details

The Data Protection team uses subscription and business information to verify identity before assisting with administrator recovery ^2^. Do not post invoices, account identifiers, payment data, or DNS verification values publicly.

What cannot be done through this forum

A Microsoft Q&A moderator cannot inspect the tenant, reset authentication methods, or directly escalate an account-specific recovery case. A support service request is required for that work ^3^.

The normal lost-phone guidance is to use another registered method or contact the organization’s administrator ^4^. Neither self-service option applies here because all alternative methods are unavailable and the affected account is the only administrator.

If telephone routing still fails

The matched Q&A recovery guidance describes creating a temporary Microsoft 365 trial tenant solely to obtain access to its admin center and open a support ticket for the original locked tenant ^3^. This does not migrate, replace, or recover data into the temporary tenant; it is only a support-contact workaround.

If that fallback is acceptable:

1. Create a temporary trial tenant under a separate account.
2. Open its Microsoft 365 admin center.
3. Create a support request titled Sole Global Administrator lockout — recovery required for another tenant.
4. Include the original tenant’s domain and request Data Protection/Tenant Recovery routing.
5. Cancel the trial after the original tenant is recovered to avoid charges.

After access is restored

• Register at least two strong authentication methods.
• Add another appropriately protected Global Administrator account.
• Test both recovery paths before closing the incident.
• Consider phishing-resistant methods such as passkeys, FIDO2 security keys, or Windows Hello for Business; Microsoft also recommends multiple authentication methods to reduce future lockout risk ^5^.

References

1. Contact Microsoft customer support
2. Sole Global Administrator Locked Out – Lost Microsoft Authenticator Access After New Phone - Microsoft Q&A
3. Global admin locked out – lost Microsoft Authenticator – onmicrosoft.com tenant - Microsoft Q&A
4. Set up multifactor authentication for your Microsoft 365 account | Microsoft Support
5. Recover user authentication methods using Microsoft Entra Backup and Recovery