Locked out of only Admin account in M365

Microsoft Support’s Data Protection/Tenant Recovery team must recover the tenant because the only Global Administrator has lost the tenant’s only registered MFA method.^1^

Open the recovery case

1. Use Microsoft’s country/region support-number directory and call the relevant number.^2^
2. Tell the agent:
   • This is Microsoft 365 for business.
   • The affected account is the sole Global Administrator.
   • Its only MFA method was Microsoft Authenticator, which is no longer available.
   • No other administrator can reset its authentication methods.
   • You need a case routed to Data Protection/Tenant Recovery for tenant-ownership verification and MFA recovery.
3. Record the support case number and use that case for all follow-up. Matching sole-administrator lockout cases have been resolved by engaging the Data Protection team to verify ownership and restore tenant access.^3^

A normal member account cannot grant itself an administrative role or reset the Global Administrator’s authentication methods. If no alternate method was registered, password-reset and security-info pages cannot bypass the MFA requirement; self-service recovery relies on a previously registered verification method.^4^

Prepare ownership evidence

Have the following available, but provide sensitive details only through the official support case:

• Tenant name and tenant ID, if known
• Affected administrator’s user principal name
• Organization name and business details
• Custom-domain ownership evidence, including the ability to modify DNS if requested
• Subscription details, previous invoices, and billing records
• Contact information associated with the subscription
• Access to any existing member account in the tenant

These are typical items used during tenant-ownership verification; Microsoft determines the precise recovery action after verification.^5^

Do not post tenant identifiers, invoices, account names, or other ownership evidence publicly.

After access is restored

1. Remove the obsolete Authenticator registration and register the replacement device.
2. Add at least one additional strong authentication method to the administrator account. Microsoft recommends multiple methods that use different channels so losing one does not cause another lockout.^6^
3. Create two cloud-only emergency-access accounts, permanently assigned Global Administrator and reserved for break-glass use. Microsoft recommends two such accounts specifically for administrator-lockout scenarios.^7^
4. Securely store their credentials, monitor them, and generate a high-priority alert whenever either emergency account is used or changed.^8^
5. Test the replacement MFA methods and emergency-access procedure before closing the recovery incident.

References

1. Global admin locked out – lost Microsoft Authenticator – onmicrosoft.com tenant - Microsoft Q&A
2. Contact Microsoft customer support
3. Microsoft365 Global Admin locked out, lost MFA (Authenticator) – need tenant recovery - Microsoft Q&A
4. Get back into your work or school account | Microsoft Support
5. Sole Global Administrator locked out due to unavailable MFA – no other admin in Microsoft 365 tenant - Microsoft Q&A
6. Create a resilient access control management strategy with Microsoft Entra ID
7. Best practices for all isolation architectures
8. Security operations for privileged accounts in Microsoft Entra ID