Sole Global Administrator Locked Out – Lost Microsoft Authenticator – MFA Reset Required

Mohammed Yasser 0 Reputation points
2026-10-13T07:42:00.46+00:00

Hello Microsoft Support Team,

I am the Global Administrator of a Microsoft 365 Business tenant and have completely lost access to my administrator account due to a Microsoft Authenticator MFA issue.

Issue description:

I recently changed my mobile phone and no longer have access to the Microsoft Authenticator registration on my previous device.

I successfully reset my administrator account password using my registered personal recovery email address. However, when attempting to sign in, Microsoft continues to require approval or a verification code from the Authenticator registered on my old device.

The Authenticator application on my new phone asks me to sign in, which creates a verification loop.

Troubleshooting already completed:

Successfully reset my account password.

Attempted to sign in through Microsoft 365 and Microsoft Entra.

Checked all available verification options; both require the old Authenticator.

Attempted to access Security Info but was blocked by MFA.

Attempted to contact Microsoft Support but could not access business technical support without signing in.

I do not have access to another Global Administrator who can reset my authentication methods.

Request for urgent assistance:

I need this issue escalated to the appropriate Microsoft Data Protection / Tenant Recovery team to verify my ownership of the tenant and reset my administrator MFA registration.

I can provide billing invoices, company registration information, my registered recovery email, and any other documentation required to verify ownership through a secure support channel.

Please advise how I can open a support case or arrange a secure verification process without signing in to the locked administrator account.

Thank you for your assistance.

Microsoft 365 and Office | Subscription, account, billing | For business | Other

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Darren Bruce 2,015 Reputation points Independent Advisor
    2026-10-13T08:49:34.0533333+00:00

    Dear Mohammed Yasser,

    Based on your description, this appears to be a sole Global Administrator lockout caused by the loss of access to the Microsoft Authenticator method previously registered for MFA. Since you do not have another Global Administrator in the tenant who can reset your authentication methods, and you are unable to access the account required to create a support request, this scenario generally requires assistance from Microsoft's account and tenant recovery processes.

    While I cannot guarantee the outcome, I have seen cases where calling back and going through the IVR flow again eventually connects customers with a support representative. I am not sure which options were selected during your earlier calls, but if you decide to try again, you may wish to follow prompts similar:

    Phone service number Customer service phone numbers - Microsoft Support

    To help you navigate the automated phone system (IVR), here's an example of what the conversation might look like:

    IVR: What kind of problem are you worried about?

    You: Admin account locked

    IVR: What kind of product do you use?

    You: Office 365 for business

    IVR: Does it count for education or business?

    You: For Business

    IVR: Are you an admin?

    You: Yes

    IVR: Do you have another administrator in your organization?

    You: No

    IVR: Need a service request?

    You: Yes

    This should help you connect with a live support agent who can help you directly.

    And if you still can't create a support ticket during the call, I recommend creating a temporary tenant account and submitting the support request from there. To create a new tenant, follow these steps:

    1. Visit Office 365 E3 - Enterprise Collaboration and Productivity | Microsoft    
    2. Select any plan and click Try for free.    
    3. Complete the setup to create a new tenant.    
    4. Ticket support: In the Microsoft 365 admin center>support>help & support. You can create a support ticket: https://admin.microsoft.com/#/support/requests     

    Important: Please remember to cancel the trial subscription once your issue is resolved to avoid any charges.

    I understand that this issue may take some time to resolve and could impact your workflow. However, the following solutions have been effective in resolving Microsoft Authenticator issues.

    If you have any other questions, please feel free to reach out.

    If the answer is helpful, please click "Yes". If you have extra questions about this answer, please click "Comment".   

    Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

    Was this answer helpful?

  2. AI answer

    2026-10-13T07:42:45.64+00:00

    Because no other administrator can reset your authentication methods, contact Microsoft’s regional business support number and request escalation to the Microsoft 365 Data Protection team for a sole Global Administrator tenant lockout and MFA recovery.^1^

    Open the recovery case by phone

    1. Open Microsoft’s customer-support page and select the Work account tab.
    2. Under Technical or Sales support phone numbers, select your region and call the listed business-support number.^2^
    3. Since the earlier support attempt did not reach the correct team, identify the case specifically as:
      • Microsoft 365 for business
      • Sole Global Administrator tenant lockout
      • Lost Microsoft Authenticator registration
      • No alternative authentication method
      • No other administrator
      • Request transfer to the Microsoft 365 Data Protection team for tenant recovery and MFA reset
    4. If the automated system asks questions, use responses such as:
      • Problem: Authenticator
      • Product: Office 365 for business
      • Account type: Company
      • Administrator: Yes
      • Another administrator available: No
      • Request: Create a service request and transfer it to the Data Protection team

    This routing has been prescribed for the same sole-administrator, lost-Authenticator scenario.^3^

    Record the case number before ending the call. Provide tenant and ownership information only through the private channel specified by the support agent—not in this public Q&A thread.

    Prepare ownership-verification information

    Have the following available:

    • Tenant’s initial onmicrosoft.com domain and any verified custom domains
    • Locked administrator sign-in name
    • Company legal name and registration information
    • Microsoft 365 subscription and billing details
    • Recent invoices or order information
    • Domain/DNS ownership evidence
    • A reachable alternate email address and telephone number
    • Any case number from the previous support contact

    A password reset does not remove the registered Authenticator method. Require re-register MFA is a separate administrative operation that deletes existing Authenticator and related MFA methods so that they can be configured again at the next sign-in.^4^ Because Security Info itself requires your unavailable MFA method, there is no remaining tenant-side self-service route in this case.

    If phone support still cannot create the case

    As a workaround, create a separate Microsoft 365 trial tenant, sign in to its admin center, and open a support request from there. In the request:

    1. State that the affected environment is a different, existing tenant.
    2. Provide the locked tenant’s domain but no passwords or verification codes.
    3. Request escalation to the Microsoft 365 Data Protection team.
    4. Reference any prior case numbers.
    5. Cancel the trial after recovery to prevent unintended billing.

    This workaround is documented in matching sole-administrator lockout cases where the normal support portal was inaccessible.^5^

    After access is restored

    Create two cloud-only emergency-access accounts permanently assigned the Global Administrator role and secure and monitor them according to Microsoft’s emergency-access guidance. Microsoft recommends at least two such accounts specifically for situations where normal administrators are locked out.^6^

    Also register more than one permitted authentication method for the normal administrator account and test the recovery process before retiring an old phone.

    References

    1. Troubleshoot sign-in issues and account access problems
    2. Contact Microsoft customer support | Microsoft Support
    3. Sole Global Admin locked out of Microsoft 365 tenant - lost Authenticator MFA - Microsoft Q&A
    4. Manage user authentication methods for Microsoft Entra multifactor authentication
    5. Global admin locked out – lost Microsoft Authenticator – onmicrosoft.com tenant - Microsoft Q&A
    6. Securing privileged access for hybrid and cloud deployments in Microsoft Entra ID
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.