Sole Global Admin locked out by MFA – need Data Protection team for admin MFA reset

Because no other administrator or MFA method exists, Microsoft Support must open a tenant-lockout case for the Data Protection/Tenant Recovery team to verify ownership and restore access; this forum cannot perform the MFA reset directly.^1^

Request the correct escalation

Since ordinary phone support returned you to the sign-in page, call the current Microsoft 365 business support number for your country/region again, but route the request explicitly as a business tenant lockout, not as routine sign-in troubleshooting. Microsoft publishes the current regional numbers under Phone support.^2^

Use these responses in the automated system or with the first agent:

• Product: Office 365/Microsoft 365 for business
• Issue: Lost access to the only administrator account
• Administrator: Yes
• Other administrators available: No
• Request:
  “Open a service request for a sole Global Administrator tenant lockout. No alternate MFA method or administrator exists. Please route the case to the Data Protection/Tenant Recovery team for ownership verification and MFA re-registration.”

This exact sole-admin/Authenticator scenario has been resolved by opening a support ticket with the Data Protection team.^3^

Have these details ready, but disclose them only through Microsoft’s private support channel, not in this public thread:

• Tenant’s initial *.onmicrosoft.com domain and verified custom domain
• Affected Global Administrator sign-in name
• Subscription/company and billing information
• Ability to create a requested DNS record
• Alternate reachable email address and phone number
• Error code 500121, timestamps, correlation/request IDs, and screenshots
• Preferred contact times and time zone

Error 500121 means that the MFA prompt was not completed; it does not by itself identify why Authenticator notifications stopped.^4^

If telephone routing still fails

Use whichever conditional route applies:

1. Existing Microsoft partner with active GDAP: Ask the partner to restore access if it has the required authentication-reset role. If it cannot, a partner with an active GDAP relationship and Service Support Administrator can open the Data Protection request on your behalf; Data Protection will still verify matters directly with you.^5^
2. Access to another Microsoft 365 business tenant: Sign in to that tenant’s admin center and select Help & support → Contact Support. Clearly identify the locked tenant and request Data Protection/Tenant Recovery. Do not create a trial solely for this unless Microsoft Support directs you to do so; if one already exists, it can provide an authenticated channel.^6^

Do not keep retrying MFA continuously. Repeated attempts can temporarily prevent additional attempts, and no self-service method can replace the only registered Authenticator method in this sole-admin situation.^7^

After access is restored

Immediately create at least two cloud-only emergency access accounts:

• Use the tenant’s *.onmicrosoft.com domain.
• Assign permanent active Global Administrator roles.
• Configure phishing-resistant authentication, such as separate FIDO2 security keys.
• Do not tie them to one person’s phone.
• Exclude them from Conditional Access policies that could block sign-in.
• Store credentials securely, monitor every use, and test them at least every 90 days.^8^

Also register more than one permitted authentication method on the normal administrator account and add a separate Privileged Authentication Administrator or additional appropriately protected administrator.

References

1. Sole Global Administrator Locked Out – Lost Microsoft Authenticator Access After New Phone - Microsoft Q&A
2. Get support for Microsoft 365 for business
3. Microsoft365 Global Admin locked out, lost MFA (Authenticator) – need tenant recovery - Microsoft Q&A
4. How to troubleshoot Microsoft Entra sign-in errors
5. Preventing tenant lockouts
6. Sole Global Administrator locked out – Authenticator MFA loop / tenant recovery required - Microsoft Q&A
7. Common problems with two-step verification for a work or school account
8. Manage emergency access accounts in Microsoft Entra ID