Sole Global Administrator Locked Out Due to MFA – Need Alternative Tenant Recovery Contact

At the MFA prompt, first select Sign in another way and use any previously registered alternative method; if no usable method appears, Microsoft Support must open and escalate a sole Global Administrator tenant-recovery case.

1. Check for an existing alternative method

1. Start signing in with the Global Administrator account.
2. At the Authenticator prompt, select Sign in another way.
3. If an office phone, SMS number, security key, or another registered method appears, select it and complete verification.
4. If the link is absent, or every offered method depends on the unavailable device, proceed to support escalation.

Microsoft documents that Sign in another way only presents methods previously registered on the account; if none were configured, administrator assistance is required.^1^

2. Open the recovery request outside the locked tenant

Because both admin portals are inaccessible and the previous telephone attempt did not reach an agent, use Microsoft’s public support page:

1. Open Contact Microsoft customer support.^2^
2. Select the work/business account path.
3. Enter a description such as:

   Sole Global Administrator locked out of a Microsoft 365 Business tenant. The password works, but the registered Authenticator device is unavailable. No alternative sign-in method is available or usable, and no other Global Administrator exists. Please open a tenant-recovery case and escalate it to the Data Protection/Tenant Recovery team.

4. Choose chat, callback, or another displayed contact method. Available options can vary by region and by the support flow.
5. Record the service-request number once the case is created.

Microsoft’s published guidance does not provide a direct public email address for the Data Protection or Tenant Recovery team. The frontline support team must create and route the case. A matching accepted Microsoft Q&A resolution directs sole administrators in this situation to contact Microsoft Support so that the frontline team can raise the Data Protection request.^3^

3. If another phone attempt is necessary

The earlier call did not reach a person, so use the regional business-support number from the public support page and explicitly navigate the call as an administrator lockout. The prompts vary by country, but the matching recovery guidance gives this example:

• Product: Office 365/Microsoft 365 for business
• Account type: Company or business account
• Are you an administrator?: Yes
• Is another administrator available?: No
• Create a service request?: Yes
• Issue: Authenticator / sole Global Administrator locked out

Microsoft publishes current regional telephone routes and notes that administrators should have their account details ready.^4^

4. Prepare for ownership verification

Have the following available privately for the assigned support agent:

• Tenant’s initial *.onmicrosoft.com domain and custom domain
• Locked administrator username
• Subscription and billing/order information
• Company identity and contact information
• Access to the subscription’s registered contact channels
• Ability to demonstrate control of the organization’s public DNS, if requested
• A reachable external email address and telephone number

Do not post tenant identifiers, invoices, verification codes, or other ownership evidence in this public forum. Community moderators cannot reset MFA; the recovery team must verify ownership before restoring administrative access.

You should not need to purchase another subscription. A temporary trial tenant appears in some Q&A answers only as a workaround when no public contact route succeeds, but it is not the primary recovery channel and does not provide direct access to the recovery team.

After access is restored

Create at least two cloud-only emergency Global Administrator accounts with independent authentication methods, secure their credentials offline, and monitor their use. Microsoft recommends two or more emergency access accounts specifically to reduce the risk of complete administrative lockout.^5^

References

1. Use a screen reader to set up and troubleshoot multifactor authentication | Microsoft Support
2. Contact Microsoft customer support | Microsoft Support
3. Microsoft 365 tenant lockout – sole global admin – MFA inaccessible - Microsoft Q&A
4. Get support - Microsoft 365 admin | Microsoft Learn
5. Manage emergency access accounts in Microsoft Entra ID