Unable to Access Global Administrator Account

Use the exact User principal name (UPN) shown on the affected user’s Microsoft Entra profile—not its display name, email address, or an assumed onmicrosoft.com address—and escalate to Microsoft’s tenant-recovery process if that exact UPN still returns “account does not exist.”

1. Verify the actual sign-in name

The screenshots establish that the user object and direct Global Administrator assignment exist, but the UPN is obscured. A UPN is the account’s Microsoft Entra sign-in name and is not necessarily the same as its email address.^1^

Using the day-to-day account that can display the tenant:

1. Open Microsoft Entra admin center → Entra ID → Users.
2. Select the affected Global Administrator user.
3. Open Properties and locate User principal name.
4. Copy that complete value directly. Do not reconstruct it from the display name or tenant name.
5. Open a private/incognito browser window and sign in with that exact UPN.

If the custom domain was previously applied to the administrator account, its current UPN might be an address under the custom domain rather than the original onmicrosoft.com address. A similar sole-admin case was resolved by using the account’s changed custom-domain UPN.^2^

If the exact UPN produces AADSTS50034, Microsoft defines that as Entra ID being unable to find that UPN in the directory.^3^

2. Try self-service recovery if it is offered

If the UPN is accepted but the password is not:

1. Go to the Microsoft work or school account password-reset page: https://passwordreset.microsoftonline.com/
2. Enter the exact UPN.
3. Complete recovery using the registered security information.

This works only if self-service password reset was enabled and recovery methods were registered.^4^

3. Escalate a sole-administrator lockout

If the exact UPN is rejected, password recovery is unavailable, and no other accessible Global Administrator exists, this is a tenant-access recovery case. Microsoft’s lockout guidance says the tenant owner must contact Microsoft Support after self-service recovery fails.^5^

1. Open Microsoft customer support.
2. Select the business/Microsoft 365 support path and Get Help.
3. State:

   “The only accessible Global Administrator identity cannot sign in. The user object is enabled and has a direct Global Administrator assignment, but the exact UPN returns ‘account does not exist.’ Please open a tenant-access recovery case and route it to the Microsoft 365 Data Protection/Tenant Recovery team.”

4. Provide privately to the support agent:
   • Tenant’s default onmicrosoft.com domain
   • Custom domain
   • Exact affected UPN
   • Tenant ID, if visible
   • Subscription or billing details
   • Reachable business email and telephone number
   • Evidence of domain and organization ownership
   • The screenshots showing the user object and role assignment

Do not post tenant IDs, unredacted UPNs, invoices, phone numbers, or verification records publicly. Microsoft support may use registered tenant contact information for verification; the documented business-support process includes PIN verification sent to a registered email address or phone number.^6^

A Q&A moderator cannot grant the role or change the tenant. Comparable sole-admin lockout cases are handled through a support ticket and the Data Protection team after ownership verification.^7^

If the subscription was purchased through a partner

Contact that Microsoft 365 reseller or Cloud Solution Provider first. If the partner has active granular delegated admin privileges with an appropriate role, it may be able to restore access or promote another account; otherwise, it can create the recovery request on the organization’s behalf.^5^

After access is restored, assign a second suitably protected administrator or Privileged Authentication Administrator and configure emergency access. Microsoft recommends administrative redundancy because another authorized administrator can reset a locked Global Administrator.^8^

References

1. Microsoft Entra UserPrincipalName population
2. login issues - Microsoft Q&A
3. Troubleshoot primary refresh token issues on Windows devices
4. Register the password reset verification method for a work or school account | Microsoft Support
5. Preventing tenant lockouts
6. Get support for Microsoft 365 for business
7. Account / Tenant Access Recovery of Sign-in issues (Entra ID). - Microsoft Q&A
8. About administrator roles in the Microsoft 365 admin center