Locked Out of Two Microsoft 365 Tenants Due to MFA — Need Official Recovery Support

Surached Chaiyakum 0 Reputation points
2026-10-22T09:43:27.54+00:00

Hello,

I am the only available administrator for two separate Microsoft 365 business tenants. I lost access to my old Microsoft Authenticator device and have no alternative MFA method.

I tried the "Require re-register multifactor authentication" option, but I am still unable to sign in. I can no longer access either Admin Center or create a support ticket.

I contacted Microsoft Support Assistant, but it could not handle this business administrator lockout. I need help reaching the appropriate Microsoft 365 Commercial Support or Data Protection team.

Could a Microsoft moderator please advise me on an official way to open a tenant recovery case without signing in to either affected tenant?

I can provide tenant IDs, administrator account details, company information, and proof of ownership through a secure private verification process.

Thank you.

Microsoft 365 and Office | Subscription, account, billing | For business | Other
0 comments

2 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-10-22T09:44:16.2633333+00:00

    Contact Microsoft 365 business phone support from the official regional-number list and explicitly request a tenant-recovery case with the Microsoft 365 Data Protection team for each locked tenant. Microsoft’s tenant-lockout guidance directs a sole Global Administrator with no other administrator or usable partner access to contact Microsoft Support.^1^

    Open the recovery cases by phone

    1. Open Microsoft’s current business-support contact page and select your country or region: ^2^
    2. Call the listed number and identify the product as Microsoft 365 for business.
    3. Tell the automated system or agent:

      I am the sole Global Administrator and cannot complete MFA because the registered Authenticator device is unavailable. There is no alternate authentication method or other administrator. I need a service request for tenant recovery and transfer to the Microsoft 365 Data Protection team.

    4. Request two separate cases, one for each tenant, and record both case numbers.
    5. Have the following ready for each case:
      • Tenant ID and primary onmicrosoft.com domain
      • Locked Global Administrator UPN
      • Custom domains associated with the tenant
      • Subscription, billing, and company details
      • A reachable external email address and telephone number
      • Any requested proof that you own or control the organization/domain

    Technical phone support is available in English 24/7, while local-language availability varies. Microsoft advises administrators to have their account details ready.^3^

    Microsoft may use PIN-based verification. If the calling number is not registered in the organization profile, the representative may send a verification code to the registered email address or telephone number.^3^ Explain immediately if those registered channels are also inaccessible; the Data Protection team must determine the available ownership-verification process.

    Since Require re-register multifactor authentication did not restore access, repeating that action will not create an authentication method you can use without another authorized administrator or a successful sign-in.

    If phone routing does not produce a case

    Create a temporary Microsoft 365 Business trial tenant using a separate, accessible account. This workaround has been recommended in accepted Microsoft Q&A answers for the same sole-administrator MFA lockout scenario.^4^

    After creating the temporary tenant:

    1. Sign in to its Microsoft 365 admin center.
    2. Select Help & support.
    3. Open a request stating that it is being submitted on behalf of two inaccessible tenants.
    4. Include both tenant IDs, but ask for a separate recovery case for each.
    5. Request transfer to the Microsoft 365 Data Protection team.
    6. Provide only non-sensitive summary information initially; send ownership documents through the secure process specified by the assigned support agent.
    7. Cancel the trial after both recovery cases are resolved to avoid unintended billing.^5^

    A Microsoft Q&A moderator cannot inspect either tenant, reset MFA, or conduct private ownership verification; account-specific recovery must proceed through a Microsoft support case.^4^

    After access is restored

    For each tenant:

    • Create at least two Global Administrator accounts with distinct credentials and authentication methods.
    • Configure two or more emergency-access (“break-glass”) accounts and monitor their use.^6^
    • Keep recovery methods current and test emergency access periodically.
    • If a Microsoft partner manages the tenants, establish appropriate GDAP roles; Privileged Authentication Administrator is required for MFA-reset actions.^1^

    References

    1. Preventing tenant lockouts
    2. Contact Microsoft customer support
    3. Get support for Microsoft 365 for business
    4. Global admin locked out – lost Microsoft Authenticator – onmicrosoft.com tenant - Microsoft Q&A
    5. Sole Global Administrator locked out of Microsoft 365 tenant due to MFA / Authenticator issue - Microsoft Q&A
    6. Manage emergency access accounts in Microsoft Entra ID
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. Nam-D 4,490 Reputation points Microsoft External Staff Moderator
    2026-10-22T10:15:22.72+00:00

    Hello @Surached Chaiyakum,

    Firstly, I would like to first clarify that this is a user‑to‑user support forum. As a Forum Moderator, I don’t have backend access to reset your MFA or create a ticket on your behalf.

    If you are the only Global Administrator and no other administrator can access the tenant, you will not be able to reset MFA from the Azure or Microsoft Entra portal yourself. In this situation, please contact Microsoft Support and request assistance from the Data Protection Team.

    Please try to find the related hotline number to call the frontline let them raise a ticket for you: Technical or Sales support phone numbers (for Work account, scroll down to find your region's number) 

    User's image

    In some countries, this is an automated conversation: First, when you call the hotline, they will ask you what kind of problem you are struggling with. 

    Answer: Lost access to global admin account

    A: What products do you use?

    B: Office 365 for business. 

    Verification: Education or company account? 

    B: For companies 

    A: Are you an administrator? 

    B: Yes. 

    A: Are there any other administrators in your organization? 

    B: No. 

    A: I need one.... Service request? 

    B: Yes 

    (Important Note: Sometimes, you would hear the computer-generated voice at first, please kindly wait for it to end, and if an agent is available, you would be directed to them and get your support. Depending on your country or region, when you call the support number, you may hear an introduction of about 30 seconds such as "You can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.) 

    As an alternative, you can create a new tenant account and submit your request from there.    

    To set up a new tenant, please follow these steps: 

    Once your tenant is created, you should be able to access the support portal and submit your ticket referencing your locked account without further issues.

    In the ticket's description, you could refer to this message

    "Hello, I am currently locked out of my Microsoft 365 tenant because multi-factor authentication is enforced, and I am unable to complete the verification process. I am the only global administrator for this tenant, which means I cannot access my account or the Microsoft 365 Admin Center. To resolve this, I have created a new tenant and would like to be connected with the Data Protection Team to verify my identity and assist with regaining access. I am available to provide any required documentation or verification to support the recovery process."

    Ticket Support: Log-in the Microsoft 365 Admin Center using the newly created trial admin account (not the currently locked one) > Support > Help & Support. You can raise support ticket at: https://admin.microsoft.com/#/support/requests   

    When you open a support ticket, please make sure to turn off the Support Assistant (AI) in the help panel.  

    Several customers have reported issues when the Support Assistant is turned on the system sometimes fails to display the “Contact Support” option.  

    As shown in the screenshot, simply switch Support Assistant > Off, then type your issue description.  Once the AI is off, the “Contact Support” button will appear normally, allowing you to submit a ticket directly.

    User's image

    • After clicking on "Help & Support" button, you can type "I need agent support via phone or email". After that, you can click on "Contact support" 
    • Choose contact method: "Phone" 
    • Fill all the information in this contact support details, please describe your situation carefully so they will have enough information to help you. 
    • Finally, click on "Contact me"
    • After completing them, you will receive an email appointment for a meeting to review this issue professionally together. 
    • For more details, you could refer to this article: Get support for Microsoft 365 for business 

    Please remember to cancel the trial subscription once your issue is resolved to avoid any unintended charges.

    Kindly let me know when there are updates or if you need further assistance. Any updates you’re able to share would be really helpful.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.