Locked out of only Admin account in M365

Caden Shrock 0 Reputation points
2026-11-10T17:34:27.6366667+00:00

We have a single admin account in our M365 tenant. The user deleted their Microsoft Authenticator app, and it was the only MFA method. How can we get back in?

Microsoft 365 and Office | Subscription, account, billing | For business | Other
0 comments

2 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Hendrix 2,770 Reputation points Independent Advisor
    2026-11-10T17:46:03.68+00:00

    Hi Caden,

    Sorry to hear you're running into this issue.

    Since this is the sole administrator account and you're locked out due to MFA, the only way to regain access is to contact Microsoft Support. They are the only team authorized to help recover access in situations involving the sole administrator account.

    Please try locating the appropriate hotline for your region here: Customer service phone numbers - Microsoft Support 

    Here are some tips and an example of a prompt to help you navigate the IVR more effectively: 

    (When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you see the options. Then press "1" for a business email user, and again "1" for technical help.)   

    • What kind of problem are you experiencing?        
    • Answer: Authenticator
    • What products do you use?        
    • Answer: Microsoft 365 for business        
    • Is this for an education or company account?        
    • Answer: For companies        
    • Are you an administrator?        
    • Answer: Yes        
    • Are there any other administrators in your organization?        
    • Answer: No. I am the only admin in my tenant         
    • Do you need a... Service request?         
    • Answer: Yes. I need to create a ticket. Please send me directly to the Data Protection Team.     

    During the phone call, you will need to provide the information associated with your subscription, such as your company name, billing details, phone number, and an alternate email address, etc. This information allows the Data Protection team to verify your identity and securely assist you in regaining access to your administrator account.     

    I also recommend calling during business hours. In my experience, it can be difficult to get through to the correct support queue, and automated systems don't always work as expected. If you can't get through on your first try, I suggest trying again later or at a different time.

    I hope this helps point you in the right direction. If you have any updates or additional questions, feel free to reply, and I'll do my best to assist further.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-11-10T17:35:17.74+00:00

    Microsoft Support’s Data Protection/Tenant Recovery team must recover the tenant because the only Global Administrator has lost the tenant’s only registered MFA method.^1^

    Open the recovery case

    1. Use Microsoft’s country/region support-number directory and call the relevant number.^2^
    2. Tell the agent:
      • This is Microsoft 365 for business.
      • The affected account is the sole Global Administrator.
      • Its only MFA method was Microsoft Authenticator, which is no longer available.
      • No other administrator can reset its authentication methods.
      • You need a case routed to Data Protection/Tenant Recovery for tenant-ownership verification and MFA recovery.
    3. Record the support case number and use that case for all follow-up. Matching sole-administrator lockout cases have been resolved by engaging the Data Protection team to verify ownership and restore tenant access.^3^

    A normal member account cannot grant itself an administrative role or reset the Global Administrator’s authentication methods. If no alternate method was registered, password-reset and security-info pages cannot bypass the MFA requirement; self-service recovery relies on a previously registered verification method.^4^

    Prepare ownership evidence

    Have the following available, but provide sensitive details only through the official support case:

    • Tenant name and tenant ID, if known
    • Affected administrator’s user principal name
    • Organization name and business details
    • Custom-domain ownership evidence, including the ability to modify DNS if requested
    • Subscription details, previous invoices, and billing records
    • Contact information associated with the subscription
    • Access to any existing member account in the tenant

    These are typical items used during tenant-ownership verification; Microsoft determines the precise recovery action after verification.^5^

    Do not post tenant identifiers, invoices, account names, or other ownership evidence publicly.

    After access is restored

    1. Remove the obsolete Authenticator registration and register the replacement device.
    2. Add at least one additional strong authentication method to the administrator account. Microsoft recommends multiple methods that use different channels so losing one does not cause another lockout.^6^
    3. Create two cloud-only emergency-access accounts, permanently assigned Global Administrator and reserved for break-glass use. Microsoft recommends two such accounts specifically for administrator-lockout scenarios.^7^
    4. Securely store their credentials, monitor them, and generate a high-priority alert whenever either emergency account is used or changed.^8^
    5. Test the replacement MFA methods and emergency-access procedure before closing the recovery incident.

    References

    1. Global admin locked out – lost Microsoft Authenticator – onmicrosoft.com tenant - Microsoft Q&A
    2. Contact Microsoft customer support
    3. Microsoft365 Global Admin locked out, lost MFA (Authenticator) – need tenant recovery - Microsoft Q&A
    4. Get back into your work or school account | Microsoft Support
    5. Sole Global Administrator locked out due to unavailable MFA – no other admin in Microsoft 365 tenant - Microsoft Q&A
    6. Create a resilient access control management strategy with Microsoft Entra ID
    7. Best practices for all isolation architectures
    8. Security operations for privileged accounts in Microsoft Entra ID
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.