Escalation to Data Protection Team: Tenant Lockout for Only Global Admin

Contact Microsoft business support by phone and request a tenant-recovery case escalated to the Data Protection team; do not post the tenant domain, administrator identity, billing data, or DNS evidence in this public forum.

Open the recovery case

1. Find the business-support telephone number for your country or region on Microsoft’s official contact page ^1^.
2. Tell the agent:

   I am the sole Global Administrator of a Microsoft Entra/Microsoft 365 tenant. The only registered Microsoft Authenticator method is unavailable, there are no other administrators or authentication methods, and sign-in fails with error 500121. Please create a tenant admin account recovery case and escalate it to the Data Protection/Tenant Recovery team.

3. Obtain and retain the support case number. Confirm that the agent recorded:
   • This is a business tenant, not a personal Microsoft account.
   • No administrator can access the tenant.
   • A Temporary Access Pass cannot be issued internally.
   • You can prove control of the custom domain and provide subscription billing evidence.

This matches other sole-Global-Administrator lockout cases in which support engaged the Data Protection team through a ticket ^2^. Microsoft Entra’s support documentation also confirms that paid and trial subscriptions can receive online and phone support ^3^.

Submit verification information privately

Provide sensitive information only through the channel supplied by the assigned support engineer. Prepare:

• Tenant’s initial *.onmicrosoft.com domain, if known
• Custom domain
• Locked-out administrator sign-in name
• Company/legal organization name
• Subscription and billing information
• An alternate email address and telephone number you can currently access
• Access to the public DNS provider so you can create the requested TXT record
• The support case number in all follow-up communications

Do not create a DNS record until support provides the exact record name and value. A closely matching recovery case confirms that Data Protection uses company, billing, contact, and subscription information to verify ownership securely ^4^.

Error 500121 means the MFA prompt was not completed; because the registered method is no longer available and there is no second administrator, retrying normal MFA enrollment does not provide a tenant-side recovery route ^5^.

After access is restored

Immediately:

1. Register at least two independent authentication methods for the recovered administrator.
2. Create dedicated emergency-access (“break-glass”) accounts.
3. Exclude those emergency accounts from Conditional Access policies that could cause another administrative lockout.
4. Secure normal privileged accounts with phishing-resistant MFA.

Microsoft specifically recommends emergency-access account exclusions so they remain usable if all regular administrators are locked out ^6^.

References

1. Contact Microsoft customer support
2. Sole Global Admin locked out of Entra ID tenant — Authenticator MFA loop / tenant lockout - Microsoft Q&A
3. Find help and get support for Microsoft Entra
4. Sole Global Administrator Locked Out – Lost Microsoft Authenticator Access After New Phone - Microsoft Q&A
5. How to troubleshoot Microsoft Entra sign-in errors
6. Require multifactor authentication for admins accessing Microsoft admin portals