Sole Global Admin locked out by MFA (Authenticator lost) – need Data Protection / Tenant Recovery escalation

Microsoft Support must open a tenant-lockout case, perform high-assurance ownership verification, and restore a designated Global Administrator’s access to the existing tenant; Microsoft Q&A cannot perform the reset or accept your tenant details privately.^1^

Open the recovery case

Since the Swiss telephone numbers have already been tried, use the public Contact Microsoft Support page as the next channel:

1. Open Contact Microsoft Support.^2^
2. Enter:
   Sole Microsoft 365 Global Administrator locked out by MFA; no alternate authentication method or administrator.
3. Select Get Help, then Contact Support if offered.
4. Choose Microsoft 365 for business, not personal Microsoft account support.
5. Ask for a service request for Microsoft Entra tenant lockout, requiring tenant ownership verification and restoration of Global Administrator access.
6. Record the case number. If the first agent treats this as an ordinary password reset, clarify that the password is known and the inaccessible factor is the sole registered MFA method.

If the web route does not expose a usable contact option, call the documented Switzerland business-support numbers again, but use the following explicit routing request. Microsoft lists 0800 662 006 and 0848 858 868 for Switzerland.^3^

“This is a Microsoft 365 business tenant lockout. I am the sole Global Administrator, my password is known, the only registered MFA method was Microsoft Authenticator on a wiped phone, and no other administrator exists. Please create a service request for high-assurance tenant ownership verification and recovery of the designated Global Administrator. I cannot open a case through the admin portal.”

This is materially different from retrying device setup or ordinary account recovery: Microsoft’s documented tenant-lockout procedure directs customers who cannot access the portals to call customer service. After ownership verification, Microsoft helps designated Global Administrators regain access to the existing tenant.^1^

Information to prepare

Provide sensitive information only to Microsoft through the support case—not in this public thread:

• Tenant’s verified domain and initial onmicrosoft.com domain, if known
• Locked administrator’s UPN
• Company legal name and address
• Subscription names, invoice numbers, and billing/payment details
• Alternate email address and telephone number
• Ability to modify the domain’s public DNS
• Any prior support case numbers

Microsoft determines the required verification steps. DNS access and invoices are useful evidence, but do not add a TXT record until the assigned support representative provides the exact record and instructions.

If the subscription was purchased through a Microsoft partner or reseller, ask that provider to open or sponsor the Microsoft support case. This is a conditional alternative only if the partner controls the support relationship.

Why a TAP cannot be created now

A Temporary Access Pass is not something the affected user can generate for themselves:

• TAP must first be enabled by an Authentication Policy Administrator.
• Creating a TAP requires an appropriate authentication administrator role and access to Microsoft Entra.
• A Privileged Authentication Administrator can create a TAP for administrators, but not for themselves.^4^

Because there is no accessible second administrator, neither the portal nor Microsoft Graph provides a self-service bypass. Support must first restore an administrative access path. Support will decide whether that involves resetting authentication methods, enabling re-registration, or another controlled recovery action.

After access is restored

1. Remove the registration for the wiped device and enroll the new Authenticator installation.
2. Register at least one additional strong authentication method.
3. Create at least one additional Global Administrator account with distinct credentials and MFA methods.
4. Establish emergency-access accounts and exclude them appropriately from policies that could cause a tenant-wide lockout.
5. Test recovery access and securely document the procedure.

Microsoft recommends at least two Global Administrator accounts with distinct credentials and MFA methods, together with emergency-access accounts, to prevent this single-admin failure scenario.^5^

References

1. Plan for tenant recoverability
2. Contact - Microsoft Support
3. Contact Microsoft customer support
4. Configure Temporary Access Pass to register passwordless authentication methods
5. Preventing tenant lockouts