Sole Global Admin locked out by MFA – Authenticator no longer has the work account – need Data Protection team

Uriel Marcovich 0 Reputation points
2026-10-16T18:28:49.2+00:00

I am the only Global Administrator of a Microsoft Entra ID (Free) tenant and I'm locked out of my admin account by MFA.

Tenant ID: [Moderator note: Personally Identifiable Information removed]

Verified domain: extraiot.com.mx

Account: the Global Admin account on that domain

After entering my password I'm prompted for MFA, but Microsoft Authenticator gets no push notification and the work account no longer appears in the app, so there's no verification code either. No other authentication methods are registered, and there is no other Global or Authentication Administrator in the tenant who could reset my methods. We have no paid Microsoft subscription, so I can't open a ticket from an admin center, and the unauthenticated "I can't sign in" support form didn't work.

Could a moderator please open a support request and escalate it to the Data Protection Team to verify tenant ownership and reset MFA registration for my admin account? I can prove ownership by adding any DNS TXT record you specify to extraiot.com.mx, and I can share contact details privately.

Microsoft 365 and Office | Subscription, account, billing | For business | Other
0 comments

3 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-10-16T18:29:45.7533333+00:00

    A moderator cannot create or escalate an account-recovery case from Microsoft Q&A; call Microsoft Support for Mexico and request a sole Global Administrator tenant-lockout case escalated to the Data Protection/Tenant Recovery team.^1^

    Contact Microsoft Support by phone

    The Microsoft support directory lists these Mexico numbers for work-account technical support:

    • 800 123 3353 — toll-free
    • 55 4777 2929 — toll

    Use the current directory to verify the number before calling.^2^

    At the automated prompts, use concise answers:

    1. Problem: “Authenticator” or “Lost access to the only administrator account.”
    2. Product: “Microsoft Entra ID” or “Office 365 for business.”
    3. Account type: “Company/work account.”
    4. Are you an administrator? “Yes.”
    5. Are there other administrators? “No, I am the sole Global Administrator.”
    6. Request:

      “Create a tenant-lockout service request. The sole Global Administrator cannot complete MFA, there are no alternate authentication methods or other administrators, and the case must be escalated to the Data Protection or Tenant Recovery team.”

    A live support agent can create the case against the affected tenant and route it for ownership verification; this is the recovery path used in matching sole-administrator lockout cases.^3^

    Have this information ready

    Provide sensitive details only through the private Microsoft support case, not in this public thread:

    • Tenant ID and affected administrator sign-in name
    • Organization name and verified domain
    • An alternate email address and reachable phone number
    • Evidence of control over the organization and domain
    • Ability to publish a DNS TXT record if the recovery agent requests one
    • Any billing, invoice, registration, or subscription information available

    Do not publish additional account identifiers, contact information, or DNS verification values here. Microsoft determines the required ownership checks and the exact DNS record, if one is needed.

    Why another MFA-reset method is not available

    The normal reset requires a different administrator to sign in to the Entra admin center, open Entra ID → Users → affected user → Authentication methods, and select Require re-register MFA. Microsoft documents that this operation requires at least an Authentication Administrator and is performed for another user.^4^

    Because this tenant has no other administrator and no usable alternate method, neither that portal operation nor PowerShell provides a bypass. The failed unauthenticated form does not change the next step; proceed through regional phone support.

    After access is restored

    1. Re-register Microsoft Authenticator and at least one additional strong authentication method.
    2. Create a second administrative account with separate credentials and MFA methods.
    3. Establish emergency-access accounts and exclude them from Conditional Access policies designed for normal administrators.
    4. Store and periodically test the recovery procedure.

    Microsoft recommends administrator redundancy and emergency-access accounts specifically to prevent complete tenant lockout.^5^

    References

    1. Sole Global Administrator Locked Out – Lost Microsoft Authenticator Access After New Phone - Microsoft Q&A
    2. [Personal account](https://support.microsoft.com/support/#microsoft-sales-support)
    3. Sole Global Admin locked out of Entra ID tenant — Authenticator MFA loop / tenant lockout - Microsoft Q&A
    4. Manage user authentication methods for Microsoft Entra multifactor authentication
    5. Preventing tenant lockouts
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. Chris-D 2,340 Reputation points Independent Advisor
    2026-10-16T18:53:04.39+00:00

    Hi Uriel,

    Thank you for sharing the details of your situation.

    As this is a user-to-user support forum, I can only offer guidance based on similar cases. I do not have access to your tenant or account. Only Microsoft Support can verify the tenant status, assist with Global Administrator/MFA recovery, and determine available recovery options.   

    If you are the only administrator and no alternative verification method is available. In this case, I recommend contacting Microsoft Support and requesting assistance from the Data Protection team. They can guide you through the tenant ownership verification process and help recover access to the administrator account. 

    In this situation, the Microsoft Data Protection team has tools and processes in place to verify identity and regain access to administrator accounts.  

    Here are some tips and an example of a prompt to help you navigate the IVR more effectively:  

    (When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)    

    In some regions, the initial interaction may be automated, so here’s a general idea of how the conversation might go to help you prepare:      

    • What kind of problem are you experiencing?         
    • Answer: Authenticator         
    • What products do you use?         
    • Answer: Office 365 for business         
    • Is this for an education or company account?         
    • Answer: For companies         
    • Are you an administrator?         
    • Answer: Yes         
    • Are there any other administrators in your organization?         
    • Answer: No. I am the only admin in my tenant          
    • Do you need a... Service request?          
    • Answer: Yes. I need to create a ticket. Please send me direct to the Data Protection Teams.      

    During the phone call, you will need to provide the information associated with your subscription, such as your company name, billing details, phone number, and an alternate email address, etc. This information allows the Data Protection team to verify your identity and securely assist you in regaining access to your administrator account.      

      

    I also recommend calling during business hours. In my experience, it can be difficult to get through to the correct support queue, and automated systems don't always work as expected. If you can't get through on your first try, I suggest trying again later or at a different time. 

      

    I know being locked out of the only admin account can be stressful, but contacting the Data Protection team is the correct path forward in this scenario. 

    I hope these steps help you create a support ticket successfully and move closer to regaining access to your administrator account. While I’m not able to intervene directly, guiding you to the right support team is the most effective help I can provide here.  

    Hope you're able to get this resolved soon. 

    If the answer is helpful, please click "Yes" and kindly upvote it. If you have any extra questions about this answer, please click "Comment".             

    Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    Was this answer helpful?

    0 comments
  3. Uriel Marcovich 0 Reputation points
    2026-10-16T19:13:03.5233333+00:00

    Hello Chris, thank you for the answer. But calling Microsoft always gets me the automate response, and it doesn't work.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.