Sole Global Admin locked out, no SSPR registered, phone support not working – need Data Protection team

The business owner must request Microsoft Entra tenant-lockout recovery from Microsoft Support and ask that the case be routed to the Data Protection/Tenant Recovery team; Microsoft will verify ownership and restore access to the existing tenant.^1^

Escalate the case from Belgium

Since ordinary support calls resulted only in transfers, use this more specific escalation:

1. Have the business owner or an authorized company representative available.
   Microsoft’s recovery team needs to work directly with the customer, even when an external administrator assists or opens the request.^2^
2. Prepare the verification information before contacting support:
   • Initial onmicrosoft.com tenant domain
   • Custom domain
   • Locked Global Administrator sign-in name
   • A separate, working contact email address
   • Contact telephone number and preferred language: Dutch
   • Subscription and billing information
   • Company registration or other organizational documents if requested
   • Ability to add a DNS TXT record
   Do not post account, billing, or ownership details publicly in this Q&A thread.
3. Call Microsoft’s Belgium business-support numbers:
   • +32 (0)800 58121 — toll-free
   • +352 (0)80 04 00 27 — toll
   These are the Belgium entries in Microsoft’s published support directory.^3^
4. Use an explicit escalation statement:

   This is a Microsoft 365 business tenant lockout. The customer has lost the password for the only Global Administrator, no SSPR methods were registered, and no other administrator exists. Please create a service request and route it to the Data Protection/Tenant Recovery team. The customer can prove domain ownership through DNS and provide billing and company records. Please record Dutch as the preferred language and use [working contact email] for written communication.

5. Before ending the call, request:
   • The support case number
   • Confirmation that the case category is tenant lockout/account recovery
   • Confirmation that it has been routed or escalated to Data Protection/Tenant Recovery
   • The external email address recorded for follow-up
   • Dutch-language handling, if available

Email-only communication cannot be guaranteed. Similar tenant-lockout cases indicate that the Data Protection team may contact the customer by email or phone after a support ticket is created.^4^

Why another password reset will not help

You have already established that neither account has registered recovery methods. Microsoft documents that when SSPR cannot verify an account because the user was not registered, an administrator must reset it.^5^ Because the affected account is the sole administrator, there is no tenant-side administrator who can perform that reset. Repeating SSPR is therefore not a useful next step.

Also, preserve the currently signed-in PC session: do not sign out, remove the account, clear credentials, or reset the computer while recovery is pending. It may continue providing temporary access to cached mail or files, but it cannot replace the tenant-recovery process.

Conditional partner route

If the external IT organization already has an active GDAP relationship with this customer:

• With an appropriate password-reset role, the partner can restore access directly.
• With Service Support Administrator, the partner can create a support request for the customer.
• Data Protection will still work directly with the end customer and needs the affected administrator’s contact details.^2^

If no active GDAP relationship and suitable role already exist, this route does not apply; proceed through Microsoft Support with the customer owner.

After access is restored

Immediately:

• Reset the affected user’s password.
• Create at least one additional Global Administrator with distinct credentials and authentication methods.
• Configure emergency-access accounts.
• Register and test SSPR/security information for administrators.
• Establish appropriate GDAP access if an external IT provider will support the tenant.

Microsoft’s tenant-lockout guidance recommends at least two Global Administrator accounts and separate emergency-access arrangements.^2^

References

1. Plan for tenant recoverability
2. Preventing tenant lockouts
3. Contact Microsoft customer support
4. Locked Out as Sole Global Admin - Microsoft Q&A
5. Register the password reset verification method for a work or school account | Microsoft Support