Sole Global Administrator Locked Out – Lost Microsoft Authenticator – MFA Reset Required

Because no other administrator can reset your authentication methods, contact Microsoft’s regional business support number and request escalation to the Microsoft 365 Data Protection team for a sole Global Administrator tenant lockout and MFA recovery.^1^

Open the recovery case by phone

1. Open Microsoft’s customer-support page and select the Work account tab.
2. Under Technical or Sales support phone numbers, select your region and call the listed business-support number.^2^
3. Since the earlier support attempt did not reach the correct team, identify the case specifically as:
   • Microsoft 365 for business
   • Sole Global Administrator tenant lockout
   • Lost Microsoft Authenticator registration
   • No alternative authentication method
   • No other administrator
   • Request transfer to the Microsoft 365 Data Protection team for tenant recovery and MFA reset
4. If the automated system asks questions, use responses such as:
   • Problem: Authenticator
   • Product: Office 365 for business
   • Account type: Company
   • Administrator: Yes
   • Another administrator available: No
   • Request: Create a service request and transfer it to the Data Protection team

This routing has been prescribed for the same sole-administrator, lost-Authenticator scenario.^3^

Record the case number before ending the call. Provide tenant and ownership information only through the private channel specified by the support agent—not in this public Q&A thread.

Prepare ownership-verification information

Have the following available:

• Tenant’s initial onmicrosoft.com domain and any verified custom domains
• Locked administrator sign-in name
• Company legal name and registration information
• Microsoft 365 subscription and billing details
• Recent invoices or order information
• Domain/DNS ownership evidence
• A reachable alternate email address and telephone number
• Any case number from the previous support contact

A password reset does not remove the registered Authenticator method. Require re-register MFA is a separate administrative operation that deletes existing Authenticator and related MFA methods so that they can be configured again at the next sign-in.^4^ Because Security Info itself requires your unavailable MFA method, there is no remaining tenant-side self-service route in this case.

If phone support still cannot create the case

As a workaround, create a separate Microsoft 365 trial tenant, sign in to its admin center, and open a support request from there. In the request:

1. State that the affected environment is a different, existing tenant.
2. Provide the locked tenant’s domain but no passwords or verification codes.
3. Request escalation to the Microsoft 365 Data Protection team.
4. Reference any prior case numbers.
5. Cancel the trial after recovery to prevent unintended billing.

This workaround is documented in matching sole-administrator lockout cases where the normal support portal was inaccessible.^5^

After access is restored

Create two cloud-only emergency-access accounts permanently assigned the Global Administrator role and secure and monitor them according to Microsoft’s emergency-access guidance. Microsoft recommends at least two such accounts specifically for situations where normal administrators are locked out.^6^

Also register more than one permitted authentication method for the normal administrator account and test the recovery process before retiring an old phone.

References

1. Troubleshoot sign-in issues and account access problems
2. Contact Microsoft customer support | Microsoft Support
3. Sole Global Admin locked out of Microsoft 365 tenant - lost Authenticator MFA - Microsoft Q&A
4. Manage user authentication methods for Microsoft Entra multifactor authentication
5. Global admin locked out – lost Microsoft Authenticator – onmicrosoft.com tenant - Microsoft Q&A
6. Securing privileged access for hybrid and cloud deployments in Microsoft Entra ID