How to fix login MFA issue

Contact Microsoft’s regional business-support number and request a tenant-lockout case with the Microsoft 365 Data Protection team, because the unavailable Authenticator belongs to the only Global Administrator and no other administrator can reset it.

1. Open the tenant-recovery case

1. Find the current number for your country or region on Microsoft’s business-support page. Microsoft advises using a neighboring country or the US support number if your country is not listed. ^1^
2. In the automated menu, use responses similar to:
   • Product: Office 365/Microsoft 365 for business
   • Issue: Microsoft Authenticator
   • Are you an administrator? Yes
   • Is there another administrator? No
   • Request: “I am the sole Global Administrator, my registered Authenticator device is unavailable, and I need a tenant-lockout case transferred to the Microsoft 365 Data Protection team.”
3. Explain that the blocked card also needs to be replaced urgently and ask for a separate billing case. Microsoft recommends separate support requests for separate issues. ^1^
4. Have these details ready:
   • Tenant name and Global Administrator sign-in name
   • Company name and contact information
   • Subscription and billing details or recent invoice information
   • An alternate reachable email address and phone number
   • Domain ownership information, if the tenant uses a custom domain

Support must validate the organization’s identity before restoring access; tenant ownership and access cannot be bypassed without that verification. ^2^

If the phone verification code is sent to a registered email address or number that is also unavailable, tell the representative immediately. Microsoft’s phone-support process can use a PIN sent to contact information registered in the organization profile. ^1^

Reinstalling Authenticator on another phone does not by itself register that device for the existing work account. A matching sole-admin lockout case requires Microsoft Support to validate ownership and reset or unblock the authentication method. ^3^

2. Replace the blocked payment card after recovery

The location depends on what is being billed.

Microsoft 365 business subscription

1. Open the Microsoft 365 admin center.
2. Go to Billing → Payment methods.
3. Add or update the payment method, then save it. A work account with billing permission is required. ^4^

Azure subscription

1. Sign in to the Azure portal as the account administrator.
2. Search for Cost Management + Billing.
3. Select the subscription, then Payment methods.
4. Select Add payment method, enter the new card, choose Make this my default payment method, and select Next. Required access differs by billing-account type; pay-as-you-go accounts require the account administrator. ^5^
5. If an invoice is already overdue, clear the outstanding balance after replacing the card; an Azure subscription can remain disabled while a balance is outstanding. ^6^

If the subscription was purchased through a reseller or Cloud Solution Provider rather than directly from Microsoft, contact that partner for both subscription and billing support. Microsoft’s direct online support requires at least one subscription purchased from Microsoft. ^1^

3. Prevent another lockout

After access is restored:

• Register the replacement phone and at least one additional authentication method.
• Create another appropriately controlled Global Administrator.
• Create two or more cloud-only emergency-access accounts, protect them with phishing-resistant authentication such as FIDO2 security keys, store their credentials securely, and test them regularly. Microsoft recommends that these accounts use the .onmicrosoft.com domain and remain independent of individual employees’ phones. ^7^

Do not publish the tenant name, administrator address, invoice, card details, or verification information in this public Q&A thread.

References

1. Get support for Microsoft 365 for business
2. Tenant access recovery
3. I am the sole Global Administrator, I have lost access to my MFA methods and I am locked out of my tenant. - Microsoft Q&A
4. [Work account](https://support.microsoft.com/accounts-billing/update-a-microsoft-account-payment-method#add-or-change-a-payment-method)
5. Add, update, or delete a payment method
6. Troubleshoot Azure payment issues
7. Manage emergency access accounts in Microsoft Entra ID