Auth Issues

Contact Microsoft 365 business support by phone and request a “Tenant Lockout / Sole Global Administrator MFA Recovery” case transferred to the Microsoft 365 Data Protection team; this cannot be escalated directly through Microsoft Q&A.

Open the recovery case

1. Find the current Microsoft support number for your country or region on the official contact page: ^1^
2. In the automated menu, identify the issue as:
   • Product: Microsoft 365 for business
   • Issue: Authenticator/MFA lockout
   • Administrator: Yes
   • Other Global Administrators: No
   • Request: Create a service request
3. When connected to an agent, use this wording:

   This is a tenant lockout. I am the sole Global Administrator, I know my password, and I have lost access to every registered MFA method after losing my previous phone. Please create a support case under the affected tenant and transfer it to the Microsoft 365 Data Protection team for tenant ownership verification and administrator MFA recovery.

Microsoft documents that when a tenant’s Global Administrator has lost access and no other Global Administrator is available, the tenant owner must contact Microsoft Support.^2^ A closely matching Microsoft Q&A case confirms that support can create the ticket and transfer it to the Data Protection team.^3^

Have ownership information ready

Provide sensitive details only to Microsoft Support through the official case or phone channel. Be prepared with:

• Tenant’s primary domain and affected administrator username
• Company legal name and address
• Microsoft 365 subscription and billing details
• Invoice, order, or subscription information
• Registered business telephone number
• An accessible alternate email address
• Domain-ownership evidence, if requested

Microsoft 365 phone support may use PIN-based verification. If the call originates from a number not registered in the organization profile, the representative may send a verification code to the registered email address or phone number.^4^ Explain immediately if those registered destinations are also inaccessible so the case can be handled as tenant recovery rather than ordinary sign-in support.

If phone support does not create the correct case

Create a temporary Microsoft 365 trial tenant, sign in as its administrator, and open a support request concerning the locked tenant:

1. Create the temporary trial tenant.
2. Open Microsoft 365 Admin Center → Help & support.
3. Enter contact support and select Contact Support.
4. Choose phone or email.
5. State prominently that the affected tenant is different and that this is a sole Global Administrator tenant lockout requiring Data Protection escalation.

This workaround is documented in matching Microsoft Q&A tenant-lockout cases.^5^ Cancel the trial afterward to avoid renewal charges.

If your Microsoft 365 subscriptions were purchased entirely through a Cloud Solution Provider rather than Microsoft, contact that partner first. Microsoft’s support guidance says partner-purchased subscriptions are supported through the partner; a partner with active GDAP and the appropriate authentication-administrator role may be able to restore access or open a Microsoft service request on your behalf.^2^

After recovery, register the new phone and create at least two Global Administrator accounts with distinct credentials and MFA methods, including appropriately secured emergency-access accounts, to prevent another tenant-wide lockout.^2^

References

1. Contact Microsoft customer support
2. Preventing tenant lockouts
3. Lost MFA for a business account - Microsoft Q&A
4. Get support for Microsoft 365 for business
5. Sole Global Administrator locked out due to Microsoft Authenticator MFA loop – Tenant Recovery needed - Microsoft Q&A