Microsoft Entra ID – MFA Lockout – Lost Authenticator Device – Admin Recovery Needed

Paolo Pusceddu 0 Reputation points
2026-11-07T13:45:03.66+00:00

Hello Microsoft Support Team,

I am the owner of a small Italian consulting company and I need assistance recovering access to our Microsoft Entra ID tenant.

The problem:

My business account is protected by Microsoft Authenticator.

The authenticator was likely registered on an old iPhone that I no longer own.

On my current iPhone, Microsoft Authenticator displays the business account but does not receive approval requests or generate verification codes.

I can access some sections of Microsoft My Account, but Security Info and the Microsoft 365 Admin Center require MFA verification, which I cannot complete.

I do not know whether another Global Administrator exists in the tenant.

I have contacted Microsoft telephone support several times, but I have been unable to reach a human operator.

What I need:

I would like to request assistance with an MFA reset or tenant administrator account recovery.

Could a Microsoft moderator help me initiate a secure support request with the appropriate account recovery or Data Protection team?

I am available to verify my identity, company ownership and domain ownership through a secure private channel.

Please let me know how to proceed without requiring authentication through the unavailable MFA method.

Thank you for your assistance.

Microsoft 365 and Office | Subscription, account, billing | For business | Other
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Paolo Pusceddu 0 Reputation points
    2026-11-07T13:49:30.7633333+00:00

    Thank you for the information.

    Unfortunately, I have already tried contacting Microsoft Italy business support several times. The automated system promises to transfer me to an operator, but I remain on hold without reaching anyone.

    I understand that this issue requires assistance from the Data Protection or Tenant Recovery team.

    Could a Microsoft moderator or support representative please help me initiate a private support request or provide an alternative written support channel?

    I cannot access the Microsoft 365 Admin Center because MFA is unavailable, and repeating the telephone procedure has not resolved the issue.

    I would appreciate assistance from a human moderator rather than another automated response.

    Thank you.

    Was this answer helpful?

  2. AI answer

    2026-11-07T13:47:05.4933333+00:00

    If no other suitably privileged administrator can reset your authentication methods, call Microsoft’s Italian business-support line and request a service ticket specifically for Data Protection/Tenant Recovery due to a sole-administrator MFA lockout.

    Contact Microsoft business support in Italy

    Since your previous calls did not reach an operator, use the documented work-account numbers and the tenant-lockout routing terms below:

    • 02 38 59 14 44 — toll
    • 800 089 761 — toll-free for local calls

    These numbers are listed under Italy → Work account → Technical or Sales support phone numbers.^1^

    When prompted by the automated system, use responses such as:

    1. Problem: “Microsoft Authenticator”
    2. Product: “Office 365 for business”
    3. Account type: “Company account”
    4. Are you an administrator? “Yes”
    5. Is there another administrator? “Unknown; I may be the only Global Administrator”
    6. Request: “I need to create a service request for a tenant lockout. Please route it to the Data Protection or Tenant Recovery team.”

    This routing has been used for closely matching cases where the sole Global Administrator lost the Authenticator device and could not access any admin portal.^2^

    Ask the agent to record these points explicitly:

    • This is a Microsoft Entra/Microsoft 365 business tenant, not a personal Microsoft account.
    • The administrator password is known, but the registered MFA device is unavailable.
    • Security Info and the Microsoft 365 Admin Center cannot be opened.
    • No alternate authentication method is available.
    • Whether another Global Administrator exists is unknown.
    • You require secure tenant-ownership verification and recovery of the administrator account.

    Prepare ownership-verification evidence

    Have the following available, but provide sensitive details only through the private Microsoft support case, not in this public forum:

    • Tenant name and tenant ID, if known
    • Affected administrator username
    • Company’s legal name and contact information
    • Custom domain and proof that the company controls it
    • Microsoft subscription details
    • Previous invoices and billing information
    • An alternate email address and phone number for contact

    These are typical details requested during tenant-ownership verification.^3^

    Microsoft Q&A moderators cannot inspect your tenant, reset MFA, or privately initiate account recovery themselves. Similar lockout cases have required a support ticket to engage the Data Protection team.^4^

    If another authorized administrator is found

    If support or a colleague confirms that another administrator exists with sufficient rights to manage authentication methods for this privileged account, that administrator can use:

    1. Microsoft Entra admin center
    2. Entra ID → Users
    3. Select the locked account.
    4. Open Authentication methods.
    5. Select Require re-register MFA.

    That action removes the listed Authenticator, phone, and software OATH methods and prompts registration of a new method at the next sign-in.^5^

    An ordinary Member account cannot perform this operation. Also, do not assume that every account carrying a basic authentication-management role can modify a Global Administrator; the assisting account must have sufficient privileges for that protected target.

    Why the account appears on the new iPhone but does not work

    Restoring Microsoft Authenticator does not restore credentials for work or school accounts. It can restore the account name, but the work account must be signed in and registered again.^6^

    Therefore, the visible account entry on your current iPhone does not establish that the new device is registered for approvals or verification codes.

    Fallback if phone routing still fails

    A closely matched Q&A answer suggests creating a temporary Microsoft 365 trial tenant, signing into its admin center, and opening a support request asking for Data Protection assistance with the original tenant.^4^

    This is a community-documented workaround, not a guaranteed official recovery channel. If used:

    • Do not reuse the locked tenant’s domain during setup.
    • Explain that the case concerns a different, inaccessible tenant.
    • Cancel the trial after recovery to avoid unintended billing.

    References

    1. [Work account](https://support.microsoft.com/support/#technical-or-sales-support-phone-numbers)
    2. Sole Global Administrator Locked Out – Lost Microsoft Authenticator Access After New Phone - Microsoft Q&A
    3. Sole Global Administrator locked out due to unavailable MFA – no other admin in Microsoft 365 tenant - Microsoft Q&A
    4. Global admin locked out – lost Microsoft Authenticator – onmicrosoft.com tenant - Microsoft Q&A
    5. Manage user authentication methods for Microsoft Entra multifactor authentication
    6. [Android](https://support.microsoft.com/authenticator/restore-account-credentials-from-microsoft-authenticator#what-information-is-restored-in-authenticator)
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.