ATTENTION : Data Protection team for tenant administrator lockout recovery.

Call Microsoft’s regional business-support number and require the agent to open a Tenant Lockout / Sole Global Administrator MFA Recovery service request for escalation to the Data Protection team. This exact scenario—sole Global Administrator, replaced phone, inaccessible Authenticator registration, and no alternate administrator—requires Microsoft Support intervention.^1^

Navigate the phone-support system

1. Find the current number for your country or region on Microsoft’s official customer-support page.^2^
2. Call and wait through the introductory message until the business-support options are offered.
3. If presented with numbered choices, select:
   • Business user/business email
   • Technical support
4. If the automated system asks questions, answer:
   • Problem: Authenticator
   • Product: Office 365 for business
   • Account type: Company account
   • Are you an administrator? Yes
   • Are there other administrators? No
   • Do you need a service request? Yes
5. When transferred to an agent, use this wording:

I am the sole Global Administrator of a Microsoft 365 Business tenant purchased directly from Microsoft. The registered Microsoft Authenticator device was wiped, there are no usable alternative authentication methods, and no other administrator can reset MFA. Password recovery succeeded but does not restore the missing MFA method. Please open a Tenant Lockout / Sole Global Administrator MFA Recovery service request and escalate it to the Data Protection team.

This IVR route and escalation wording are documented in closely matching tenant-lockout cases.^3^

Have verification information ready

Prepare the information associated with the subscription:

• Tenant’s initial domain and custom domain
• Locked administrator sign-in address
• Company name and address
• Subscription and billing details
• Recent invoice or payment information
• Registered telephone number
• An accessible alternate email address
• Any existing support-reference numbers

Microsoft’s business-support process requires account details when calling. It can also use PIN-based verification through the email address or phone number registered in the organization profile.^4^

Identity verification through the backup email or telephone and a successful password reset do not remove the tenant’s MFA requirement. MFA remains a separate sign-in verification step, so repeating password recovery will not register the new Authenticator installation.^5^

If phone support still redirects to an MFA-protected website

Create a temporary Microsoft 365 trial tenant under a different accessible account, then:

1. Sign in to that temporary tenant’s Microsoft 365 admin center.
2. Open Help & support.
3. Submit a service request identifying the locked tenant and requesting escalation to the Data Protection team.
4. State clearly that the temporary tenant is only being used because the sole administrator cannot authenticate to the original tenant.
5. Cancel the trial after the original tenant has been recovered to avoid charges.

The temporary tenant does not grant access to the locked tenant; it only provides an authenticated channel for opening the support request.^3^

After recovery, register the new Authenticator and establish at least one additional appropriately secured administrative recovery account. Microsoft recommends more than one emergency-access account to prevent a future sole-administrator lockout.^6^

References

1. Sole Global Administrator Locked Out – Lost Microsoft Authenticator Access After New Phone - Microsoft Q&A
2. Contact Microsoft customer support
3. Sole Global Administrator locked out by Microsoft Authenticator – Tenant Recovery needed - Microsoft Q&A
4. Get support for Microsoft 365 for business
5. Set up multifactor authentication for your Microsoft 365 account | Microsoft Support
6. Admin account security in Microsoft 365 for business