Microsoft 365 Business tenant lockout

Microsoft Learn Q&A cannot open or transfer a service request, so contact Microsoft 365 business support by phone and request that the case be escalated to the Data Protection team for tenant administrator recovery.

Open the recovery case

1. Open Microsoft’s country/region support-number list and select the appropriate Microsoft 365 business support number: ^1^
2. Tell the automated system and agent:

   Microsoft 365 business tenant lockout. The sole Global Administrator cannot sign in, self-service recovery failed, and no other administrator is available. Please create a service request under the affected tenant and transfer it to the Data Protection team for tenant administrator recovery.

3. Have these details ready:
   • Affected tenant’s initial *.onmicrosoft.com domain and custom domain.
   • Locked Global Administrator username.
   • Subscription and billing details.
   • Tenant ID, if available from existing records.
   • A working external email address and telephone number.
   • Evidence that the organization controls the custom domain, plus official business documentation if requested.

Microsoft requires identity and organizational-ownership verification before restoring administrative control; tenant access cannot be granted by bypassing that process.^2^ A closely matching sole-administrator lockout case confirms that support can create the ticket and transfer it to Data Protection.^3^

Phone support may use PIN-based verification. If the call originates from a number not registered in the organization profile, the representative may send a verification code to the registered email address or telephone number.^4^ Explain immediately if those registered channels are also inaccessible so that the case records the complete lockout.

If the tenant was purchased or managed through a partner

Contact that Microsoft partner first and ask whether it has an active GDAP relationship with the Service Support Administrator role. If it does, the partner can create the service request on the tenant’s behalf and include the affected administrator’s external telephone and email contact details. The Data Protection team will still work directly with the end customer.^5^

If the partner lacks the required GDAP access, use the Microsoft support phone route above; establishing new delegated access cannot itself resolve an existing complete lockout.

After access is restored

Create administrative redundancy:

• Maintain at least two Global Administrator accounts with distinct credentials and MFA methods.
• Configure and monitor emergency-access accounts.
• Keep self-service recovery methods current.
• Assign a Privileged Authentication Administrator who can recover a locked Global Administrator while following least-privilege practices.^6^

References

1. Contact Microsoft customer support
2. Tenant access recovery
3. Global Administrator Locked Out | MFA Reset request. On behalf of a Microsoft Business 365 Account - Microsoft Q&A
4. Get support for Microsoft 365 for business
5. Preventing tenant lockouts
6. About administrator roles in the Microsoft 365 admin center