Subject: Microsoft 365 Admin Access Blocked — Error 399287

Ismael Lopez 0 Reputation points
2026-10-29T14:10:16.2333333+00:00

I need to recover access to my Microsoft 365 business account. The only multi-factor authentication method available to me is SMS, but when I request a verification code, I receive error 399287.

Error Code: 399287

Request ID: [Moderator note: Personally Identifiable Information removed]

Correlation ID: [Moderator note: Personally Identifiable Information removed]

Timestamp: 2026-10-29T13:40:58Z

I would like you to investigate whether SMS verification is being blocked by Microsoft's anti-fraud protection in Microsoft Entra ID (Bad Reputation) and guide me through the process of recovering administrative access to my Microsoft 365 tenant.

I do not have any alternative authentication method available to sign in.

Please let me know how I can verify my identity and regain access to my account as soon as possible.

Thank you for your assistance

Microsoft 365 and Office | Subscription, account, billing | For business | Other
0 comments

3 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-10-29T14:11:49.98+00:00

    Because SMS is your only registered method, contact Microsoft 365 business support and request escalation to the Data Protection team if no other authorized administrator or GDAP partner can access the tenant. ^1^

    If you are the only accessible administrator

    1. Open the Microsoft 365 business support contact page and select the telephone number for your country or region. ^2^
    2. Tell the agent:
      • This is a Microsoft 365 business tenant lockout.
      • The affected account is an administrator.
      • SMS is the only registered MFA method.
      • SMS fails with error 399287.
      • No other administrator or authentication method is available.
      • You need a support case opened under the affected tenant and escalated to the Microsoft 365 Data Protection team for identity/tenant-ownership verification and MFA access recovery.
    3. Supply these diagnostics privately to the support agent:
      • Request ID
      • Correlation ID
      • Exact UTC timestamp
      • Affected administrator sign-in name and tenant/domain details
      • Reachable business contact information
      • Any subscription, billing, domain-ownership, or company-registration evidence requested for verification

    Your correlation ID and timestamp allow Microsoft to trace the MFA request. For telecom investigations, fresh examples from the last 48–72 hours may be required, so retain any new IDs if Support asks you to make another attempt. ^3^

    Do not post tenant IDs, phone numbers, invoices, or identity documents in this public Q&A thread. Only provide them through the private channel attached to the official support case.

    Does error 399287 prove “Bad Reputation”?

    No. The code and SMS failure alone do not conclusively establish that Microsoft’s anti-fraud system assigned a bad-reputation flag. Microsoft documents that unusual activity and repeated verification requests can temporarily prevent further MFA attempts, while delivery can also fail because of carrier-level filtering or regional routing. Avoid repeated code requests because they may prolong a temporary block. ^4^

    However, a closely matching Microsoft Q&A case involving Microsoft 365, SMS-only verification, and error 399287 was resolved when engineering cleared the bad reputation and unblocked MFA from the backend. That makes a backend-unblock review an appropriate explicit request in your support case, but only Microsoft Support can confirm whether that condition exists for your account. ^5^

    If another authorized administrator is available

    Ask a Global Administrator or appropriately privileged authentication administrator to perform these checks:

    1. In the Microsoft Entra admin center, open Entra ID → Users → affected user.
    2. Check whether Block sign in is enabled; if it is, disable it. Microsoft’s MFA troubleshooting procedure identifies this as a specific check when a Global Administrator cannot receive SMS or voice verification. ^6^
    3. Open Authentication methods and verify that the private authentication phone method—not merely the public profile phone field—is correct.
    4. If appropriate, select Require re-register MFA. This deletes registered phone, Authenticator, and software OATH methods and prompts the user to register again at the next sign-in. The administrator must have a suitable authentication role. ^7^

    Require re-register MFA does not necessarily clear a backend phone-reputation block. If correcting the number or re-registering MFA still produces 399287, continue with the Microsoft Support case and request backend unblock review.

    If your Microsoft 365 tenant is managed through a Cloud Solution Provider, an active GDAP partner with the necessary roles may be able to restore access or create the support request. Without appropriate GDAP access or another Global Administrator, the tenant owner must contact Microsoft Support. ^8^

    After access is restored

    Register a non-telephony authentication method and establish administrator redundancy. Microsoft recommends keeping at least a Privileged Authentication Administrator available because that role can recover a locked-out Global Administrator. ^9^

    References

    1. Troubleshoot sign-in issues and account access problems
    2. Contact Microsoft customer support
    3. Troubleshoot MFA voice call and SMS problems
    4. Common problems with two-step verification for a work or school account
    5. Microsoft 365 admin center - Unable to login by verifying using SMS - Microsoft Q&A
    6. You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
    7. Manage user authentication methods for Microsoft Entra multifactor authentication
    8. Preventing tenant lockouts
    9. About administrator roles in the Microsoft 365 admin center
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. Ismael Lopez 0 Reputation points
    2026-10-29T14:14:11.1533333+00:00

    Thank you for the information.

    However, I cannot follow these steps because I am unable to sign in to the affected Microsoft 365 account. SMS is my only registered authentication method, and it fails with error 399287.

    The account I am using to participate in this Q&A is not the account I am having trouble accessing. The affected account is:

    [Removed PII @lucasduranparietti.onmicrosoft.com]

    I do not have access to another authentication method or another administrator account that can help me recover access.

    I need Microsoft Support to review the mobile phone authentication method associated with this account and investigate whether an MFA or SMS verification block is preventing me from signing in.

    Could you please advise me on how to request an escalation to the Microsoft 365 Data Protection team for identity verification and account access recovery, given that I cannot sign in to the affected tenant?

    Thank you for your help.

    Was this answer helpful?

    0 comments
  3. Julie Huynh 4,355 Reputation points Independent Advisor
    2026-10-29T15:51:25.7566667+00:00

    Dear @Ismael Lopez ,

    Good day! Welcome to Microsoft Q&A forum!

    First of all, I would like to clarify that this is a community forum where users help one another. No one here, including myself, has access to your Microsoft 365 tenant, account details, billing information, or authentication settings, and therefore cannot reset MFA methods, verify tenant ownership, create support requests, or directly engage the Data Protection Team on your behalf.

    Regarding your situation, error code 399287 generally indicates that Microsoft is unable to complete the SMS-based MFA verification process for the registered phone number, which can occur due to service-side validation, phone reputation, or backend authentication issues even when the password and phone number are correct.

    If you're the only admin, in this situation, the Microsoft Data Protection Team has tools and processes in place to verify identity and regain access to administrator accounts.

    Please try to find the related hotline number to call the frontline let them raise a ticket for you: Technical or Sales support phone numbers (for Work account, scroll down to find your region's number) 

    In some countries, this is an automated conversation: First, when you call the hotline, they will ask you what kind of problem you are struggling with. 

    Answer: Authenticator. 

    A: What products do you use? 

    B: Office 365 for business. 

    Verification: Education or company account? 

    B: For companies 

    A: Are you an administrator? 

    B: Yes. 

    A: Are there any other administrators in your organization? 

    B: No. 

    A: I need one.... Service request? 

    B: Yes 

    (Important Note to reach a live support agent: Sometimes, you would hear the computer-generated voice at first, please kindly wait for it to end, and if an agent is available, you would be directed to them and get your support. Depending on your country or region, when you call the support number, you may hear an introduction of about 30 seconds such as "You can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.) 

    Also, could you kindly check if you know someone with Admin rights to a Microsoft 365 Business tenant that could help raise a support ticket on your behalf (with your contact information in the ticket's description so that the Data Protection Team could reach out to you)?

    As an alternative, you can create a new tenant account and submit your request from there.    

    To set up a new tenant, please follow these steps: 

    Once your tenant is created, you should be able to access the support portal and submit your ticket referencing your locked account without further issues.

    In the ticket's description, you could refer to this message "Hello,

    I am currently locked out of my Microsoft 365 tenant because multi-factor authentication is enforced, and I am unable to complete the verification process because of the error 399287. I am the only global administrator for this tenant, which means I cannot access my account or the Microsoft 365 Admin Center.

    To resolve this, I have created a new tenant and would like to be connected with the Data Protection Team to verify my identity and assist with regaining access. I am available to provide any required documentation or verification to support the recovery process."

    Ticket Support: Log in the Microsoft 365 Admin Center using the newly created trial admin account (not the currently locked one) > Support > Help & Support. You can raise support ticket at: https://admin.microsoft.com/#/support/requests   

    When you open a support ticket, please make sure to turn off the Support Assistant (AI) in the help panel.  

    Several customers have reported issues when the Support Assistant is turned on  the system sometimes fails to display the “Contact Support” option.  

    As shown in the screenshot, simply switch Support Assistant > Off, then type your issue description.  Once the AI is off, the “Contact Support” button will appear normally, allowing you to submit a ticket directly.  

    User's image

    • After clicking on "Help & Support" button, you can type "I need agent support via phone or email". After that, you can click on "Contact support" 
    • Choose contact method: "Phone" 
    • Fill all the information in this contact support details, please describe your situation carefully so they will have enough information to help you. 
    • Finally, click on "Contact me"
    • After completing them, you will receive an email appointment for a meeting to review this issue professionally together. 
    • For more details, you could refer to this article: Get support for Microsoft 365 for business 
    • This new trial tenant will not give you access to any of the data or settings in your original locked tenant. It is solely a temporary means to contact Microsoft support.   
    • Be prepared for Microsoft support to ask for verification of your identity and administrative rights for the locked tenant.   
    • The resolution time might be longer as you are contacting support from a different tenant.   
    • Remember to cancel the trial subscription for the new tenant once your issue with the original account is resolved to avoid any unintended charges. You can typically do this within the Microsoft 365 Admin Center under "Billing" > "Your products."

    Once access has been restored, I would recommend registering multiple authentication methods and maintaining at least one additional emergency administrator account to help prevent a similar lockout situation in the future.

    Kindly let me know when there are updates or if you need further assistance. Any updates you’re able to share would be really helpful.

    I'm here and happy to help! Thank you for your kindness and patience! 

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.