Talk with technical support cannot authenticate user no longer available

Contact Microsoft Support by phone and request Microsoft Entra tenant recovery for a sole Global Administrator locked out by unavailable Authenticator MFA; Microsoft must verify tenant ownership before restoring access to the existing tenant.^1^

Contact support without signing in

1. Open Microsoft’s regional support-number list and call the business-support number for your country or region.^2^
2. In the automated system, identify the issue as:
   • Microsoft 365 for business
   • Authenticator/MFA
   • Administrator
   • No other administrator available
   • Service request required
3. Tell the agent:

   The Authenticator user has left the business. This is a tenant lockout: there is no other Global Administrator and no usable MFA method. Please open a tenant-recovery case and route it to the team responsible for ownership verification and administrator access recovery.

4. Have these details available:
   • Tenant’s primary domain and onmicrosoft.com domain
   • Locked administrator username
   • Subscription, order, or invoice details
   • Billing records and payment details
   • Proof that the business controls its verified domain
   • Registered business contact email and telephone number
   • A separate reachable email address and telephone number for case updates

Microsoft uses a high-assurance process to validate tenant ownership and then helps a designated Global Administrator regain access; it recovers the existing tenant rather than issuing a replacement.^1^ Phone support may also send a verification code to the email address or telephone number registered in the organization profile.^3^

If the telephone route cannot create the case

Create a temporary Microsoft 365 Business trial tenant with an email address that is not part of the locked tenant. This is only a channel for submitting the recovery request:

1. Sign in to the temporary tenant’s Microsoft 365 admin center.
2. Select Help & support at the bottom right.
3. Enter contact support.
4. If the suggested results do not help, select Contact Support (headset).
5. Choose Phone or Email, then provide the locked tenant’s domains and explain that its sole Global Administrator cannot complete MFA.^3^
6. Ask for the case to be handled as tenant recovery after ownership verification.

This workaround has been used for the same sole-administrator Authenticator lockout scenario.^4^ Cancel the trial afterward to prevent renewal or charges.

If Microsoft 365 was purchased through a partner

If all subscriptions were bought through a Microsoft partner, contact that partner first; Microsoft’s online support requires at least one subscription purchased directly from Microsoft.^3^ A partner with an active GDAP relationship and the required password/MFA-reset role may restore access directly. Without suitable GDAP access, the tenant owner must contact Microsoft Support.^5^

After access is restored

Immediately:

• Create at least one additional Global Administrator with separate credentials and MFA methods.
• Create and monitor emergency-access accounts.
• Register at least two strong authentication methods for administrator accounts.
• Remove the former employee’s authentication methods and revoke their access.

Microsoft recommends at least two Global Administrator accounts with distinct credentials and MFA methods to prevent another tenant lockout.^5^

References

1. Plan for tenant recoverability
2. Contact Microsoft customer support
3. Get support for Microsoft 365 for business
4. Sole Global Administrator locked out due to Microsoft Authenticator MFA loop – Tenant Recovery needed - Microsoft Q&A
5. Preventing tenant lockouts