Urgent: Tenant Recovery Request - MFA Lockout

Open a tenant-lockout case by calling Microsoft’s regional business support number and request recovery of the existing tenant through tenant-ownership verification. Microsoft documents phone support as the path when administrative portals are inaccessible; after ownership is verified, Microsoft helps a designated Global Administrator regain access rather than creating a replacement tenant.^1^

Open the recovery case

1. Find the number for your country or region on the official Microsoft support contact page.^2^
2. Select or request Microsoft 365 for business technical support.
3. Tell the agent:

   I am the sole Global Administrator of a Microsoft 365 business tenant. The password is known, but the registered Microsoft Authenticator method is unavailable, and there is no other administrator who can reset my authentication methods. I need a tenant-lockout recovery case and tenant-ownership verification so that the designated Global Administrator can regain access.

4. If the automated system asks:
   • Product: Office 365/Microsoft 365 for business
   • Issue: Authenticator or MFA
   • Administrator: Yes
   • Another administrator available: No
   • Required action: Create a service request for tenant recovery
   Comparable sole-administrator cases are routed to the Microsoft support team handling identity validation and account-level recovery.^3^
5. Record the case number, the alternate contact address supplied to Support, and any requested follow-up deadline. Do not post invoices, domain records, or account details in this public forum.

Prepare for ownership verification

Have the following available, but submit them only through the channel specified by the assigned Microsoft Support agent:

• Tenant’s initial *.onmicrosoft.com domain and verified custom domains
• Locked Global Administrator sign-in name
• Company’s legal and trading names
• Subscription and billing information
• Previous Microsoft invoices or order details
• Business registration information
• Access to the custom domain’s DNS records, if domain validation is requested
• A reachable alternate email address and telephone number
• Existing case numbers and an approximate timeline of the lockout

Microsoft uses a high-assurance identity-verification process before recovering access to the existing tenant.^1^ Support—not a forum moderator—must determine the exact evidence required and the recovery action available after validation.

Check documented recovery options first, if available

• On the MFA prompt, select Sign in another way only if another previously registered method is displayed and remains accessible.
• If an emergency or “break-glass” Global Administrator account was created previously, use that account to recover access. Emergency accounts are specifically intended for cases where administrators’ MFA devices are unavailable.^4^

If neither option exists, a standard user account cannot perform administrative recovery merely because it belongs to the same tenant. Continue with the support case rather than repeatedly attempting authentication; repeated attempts can trigger temporary sign-in protection.^5^

After access is restored

1. Register new authentication methods for the recovered administrator.
2. Create at least two dedicated emergency-access accounts and secure and monitor them according to Microsoft’s guidance.^4^
3. Maintain at least two Global Administrator accounts with distinct credentials and MFA methods; Microsoft’s tenant-lockout guidance recommends this redundancy.^6^
4. Test emergency access periodically and retain the recovery procedure and support information somewhere that does not depend on access to the locked tenant.

References

1. Plan for tenant recoverability
2. Contact Microsoft customer support
3. Unable to access Microsoft 365 tenant – Lost MFA device (Sole Global Administrator) - Microsoft Q&A
4. Manage emergency access accounts in Microsoft Entra ID
5. Common problems with two-step verification for a work or school account
6. Preventing tenant lockouts