Sole Global Admin locked out, no SSPR registered, phone support not working – need Data Protection team

strattonadmin 0 Reputation points
2026-11-04T12:52:04.08+00:00

Hello,

I am the external IT administrator for a small business in Belgium. We have lost access to their Microsoft 365 tenant and have not been able to get help through the normal channels.

Tenant details

  • Tenant: dapdebascule.onmicrosoft.com
  • Custom domain: debascule.be
  • Global Administrator: [[Moderator note: Personally Identifiable Information removed] @dapdebascule.onmicrosoft.com] (the only admin account)
  • User account: [[Moderator note: Personally Identifiable Information removed] (not an admin)

The problem

  • The passwords of both the admin account and [Moderator note: Personally Identifiable Information removed]] are unknown. The customer cannot remember them, and the old passwords we have on file no longer work.
  • Self-service password reset is not possible on either account. The message says no recovery methods were registered.
  • There are no other administrators in the tenant.
  • The only device still signed in is the customer’s old PC. They need access to set up their mailbox on a new PC.

What we have tried

  • Phone support several times. Each call was transferred between departments without a result. Communication was also very difficult because of the language barrier: we are Dutch-speaking (Belgium), and it was hard to explain the issue clearly by phone in English.
  • Opening a support ticket online. This was not possible without access to the admin account, and it did not work from a separate trial tenant either.

What we can provide

  • Full access to the public DNS of debascule.be. We can add any TXT record you ask for to prove domain ownership.
  • Billing and payment details of the subscription, if needed.

Request Could a moderator please help us reach the Data Protection team for Global Admin account recovery? We would strongly prefer to communicate by e-mail rather than by phone, or with a Dutch-speaking engineer if one is available.

Thank you very much for your help. Moderator Moved from Microsoft 365 and Office | Access | For business | Other

Microsoft 365 and Office | Subscription, account, billing | For business | Other
0 comments

2 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Liora 3,525 Reputation points Independent Advisor
    2026-11-04T13:24:14.8566667+00:00

    Please note that this forum is a community support space, so I don’t have the ability to access tenant data or perform actions such as resetting MFA/security information directly. I can only guide you based on documented processes and experience, but I will do my best to point you in the right direction so this can be resolved properly.

    Dear @strattonadmin,

    I hope you’re having a good day 

    I'm sorry to hear you're facing this situation.

    Based on your description, this appears to be a full tenant administrator lockout. Since the only Global Administrator password is unknown, no recovery methods were registered for SSPR, and there are no other administrator accounts available, the normal self-service recovery options are no longer available.

    The most important detail is that you still have control of debascule.be and can manage its DNS records, and you also have access to the subscription's billing information. Those are valuable forms of ownership evidence that may be used during a tenant recovery process.

    I recommend contacting Microsoft Support again and clearly describing the situation as a tenant ownership verification / administrator recovery request.

    I would also recommend calling during opening hours when possible. From my experience, it can be difficult to reach the right support queue at times, and automated systems don't always behave as expected. If you can't get through on the first try, consider trying again later or at a different time of day.

    One additional option, if you have already tried creating a trial tenant in the past, is to attempt opening a support request from that tenant again. If that is no longer available, you may consider creating a new Microsoft 365 trial tenant solely for the purpose of contacting Microsoft Support.

    You can create a trial tenant here: Compare Office 365 Enterprise Pricing and Plans | Microsoft 365

    Once the trial tenant is created and you can access the  Microsoft 365 admin center and click Support > Help & support icon to raise your ticket.

    User's image

    X Self Help Contact Support Support History Get support from an agent Choose a contact method We'll ask you to provide some more information based on the method you choose. Phone For critical service requests, give us your number and we'll call you. Email Connect with us through email and the service request.

    When raising the case, clearly state that:

    • You are opening the request on behalf of the affected tenant that is currently locked out.
    • No administrator account is accessible.
    • You require tenant ownership verification and administrator recovery assistance.

    Support should then be able to create or transfer the case under the affected tenant and, where appropriate, route it through the recovery and ownership-verification process.

    Please keep in mind that these cases can take longer than standard support requests because they often require additional ownership validation. Unfortunately, neither the community nor forum moderators have access to Microsoft's internal systems and cannot accelerate that process.

    If you do create a temporary trial tenant for this purpose, remember that it will not provide access to any data or settings from the original tenant. It is simply a way to reach Microsoft Support and open a case when direct access to the affected tenant is unavailable.

    I hope this information helps. Please feel free to share any updates on the outcome, as it may help others facing similar tenant recovery situations in the future.

    Warm regards,  

    If the answer is helpful, please select "Yes, accept answer". If you have any questions or new updates, please feel free to comment below. 

    Was this answer helpful?

  2. AI answer

    2026-11-05T09:08:46.2433333+00:00

    The business owner must request Microsoft Entra tenant-lockout recovery from Microsoft Support and ask that the case be routed to the Data Protection/Tenant Recovery team; Microsoft will verify ownership and restore access to the existing tenant.^1^

    Escalate the case from Belgium

    Since ordinary support calls resulted only in transfers, use this more specific escalation:

    1. Have the business owner or an authorized company representative available.
      Microsoft’s recovery team needs to work directly with the customer, even when an external administrator assists or opens the request.^2^
    2. Prepare the verification information before contacting support:
      • Initial onmicrosoft.com tenant domain
      • Custom domain
      • Locked Global Administrator sign-in name
      • A separate, working contact email address
      • Contact telephone number and preferred language: Dutch
      • Subscription and billing information
      • Company registration or other organizational documents if requested
      • Ability to add a DNS TXT record
      Do not post account, billing, or ownership details publicly in this Q&A thread.
    3. Call Microsoft’s Belgium business-support numbers:
      • +32 (0)800 58121 — toll-free
      • +352 (0)80 04 00 27 — toll
      These are the Belgium entries in Microsoft’s published support directory.^3^
    4. Use an explicit escalation statement:

      This is a Microsoft 365 business tenant lockout. The customer has lost the password for the only Global Administrator, no SSPR methods were registered, and no other administrator exists. Please create a service request and route it to the Data Protection/Tenant Recovery team. The customer can prove domain ownership through DNS and provide billing and company records. Please record Dutch as the preferred language and use [working contact email] for written communication.

    5. Before ending the call, request:
      • The support case number
      • Confirmation that the case category is tenant lockout/account recovery
      • Confirmation that it has been routed or escalated to Data Protection/Tenant Recovery
      • The external email address recorded for follow-up
      • Dutch-language handling, if available

    Email-only communication cannot be guaranteed. Similar tenant-lockout cases indicate that the Data Protection team may contact the customer by email or phone after a support ticket is created.^4^

    Why another password reset will not help

    You have already established that neither account has registered recovery methods. Microsoft documents that when SSPR cannot verify an account because the user was not registered, an administrator must reset it.^5^ Because the affected account is the sole administrator, there is no tenant-side administrator who can perform that reset. Repeating SSPR is therefore not a useful next step.

    Also, preserve the currently signed-in PC session: do not sign out, remove the account, clear credentials, or reset the computer while recovery is pending. It may continue providing temporary access to cached mail or files, but it cannot replace the tenant-recovery process.

    Conditional partner route

    If the external IT organization already has an active GDAP relationship with this customer:

    • With an appropriate password-reset role, the partner can restore access directly.
    • With Service Support Administrator, the partner can create a support request for the customer.
    • Data Protection will still work directly with the end customer and needs the affected administrator’s contact details.^2^

    If no active GDAP relationship and suitable role already exist, this route does not apply; proceed through Microsoft Support with the customer owner.

    After access is restored

    Immediately:

    • Reset the affected user’s password.
    • Create at least one additional Global Administrator with distinct credentials and authentication methods.
    • Configure emergency-access accounts.
    • Register and test SSPR/security information for administrators.
    • Establish appropriate GDAP access if an external IT provider will support the tenant.

    Microsoft’s tenant-lockout guidance recommends at least two Global Administrator accounts and separate emergency-access arrangements.^2^

    References

    1. Plan for tenant recoverability
    2. Preventing tenant lockouts
    3. Contact Microsoft customer support
    4. Locked Out as Sole Global Admin - Microsoft Q&A
    5. Register the password reset verification method for a work or school account | Microsoft Support
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.