Unable to Login to Microsoft Admin Console

If no alternative verification method is registered, another tenant administrator must require MFA re-registration for your account; if you are the only administrator, contact Microsoft business support for tenant-access recovery.

If another administrator can access the tenant

Ask a Global Administrator, Privileged Authentication Administrator, or appropriately authorized Authentication Administrator to:

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID → Users.
3. Select your administrator account.
4. Select Authentication methods.
5. Select Require re-register MFA, and confirm.

This removes the registered phone, Authenticator, and software OATH methods and prompts you to configure MFA again at the next sign-in.^1^

After the reset:

1. Sign in again.
2. Complete the MFA registration prompt.
3. Register Microsoft Authenticator or another organization-approved method rather than depending solely on SMS.
4. Add a second permitted method as a recovery option.

If you are the only administrator

You cannot reset your own authentication methods while locked out. Contact Microsoft business support using the regional contact options and request:

Tenant access recovery / Data Protection assistance for a sole administrator locked out by MFA, error 399287.

Use the official support directory.^2^ Provide the support agent with:

• Organization and subscription details
• A reachable alternate email address and telephone number
• Affected administrator username and tenant domain
• Error code 399287
• Request ID, correlation ID, and timestamp shown on the error page
• Confirmation that no other administrator can reset MFA, if applicable

Do not post tenant IDs, telephone numbers, billing details, or administrator addresses publicly. Microsoft Support will need to verify tenant ownership before changing authentication access. Matching 399287 lockout cases use this same escalation path when no second administrator exists.^3^

If your organization has a Microsoft partner with an active GDAP relationship and suitable access-related permissions, contact that partner first; it might be able to restore access or create the support request on your behalf. Without another administrator or an appropriately authorized partner, the tenant’s Global Administrator must contact Microsoft Support.^4^

While arranging recovery

• If the sign-in page displays Sign in another way or Other verification options, use a previously registered method. A new Authenticator installation cannot serve as an already registered method.
• Avoid repeatedly requesting SMS codes. Repetitive requests can prolong a temporary verification block; Microsoft recommends trying another registered method or waiting before another attempt.^5^
• Changing the password alone will not reset the MFA registration.

After access is restored, maintain at least two administrator accounts with distinct credentials and MFA methods, plus documented emergency-access arrangements, to prevent another tenant-wide lockout.^4^

References

1. Manage user authentication methods for Microsoft Entra multifactor authentication
2. Contact Microsoft customer support
3. Error Code: 399287 MFA via SMS not working - Microsoft Q&A
4. Preventing tenant lockouts
5. Troubleshoot verification code issues for work or school accounts | Microsoft Support