Sole admin locked out of Azure tenant by MFA, still being billed, need cancellation or MFA reset

Submit an unauthenticated Azure billing support request asking Microsoft to stop the pay-as-you-go subscription immediately, while requesting a separate Data Protection escalation to recover the sole administrator account.

1. Stop further Azure charges

Since portal support and a ticket from another directory already failed, use Microsoft’s unauthenticated Azure support-request page:

Create an Azure support request

Microsoft’s Azure subscription sign-in guidance specifically directs customers who cannot sign in to that support route.^1^

Classify the request as Billing / Subscription management, not a general technical issue. Include:

• Immediate request: Cancel the affected pay-as-you-go subscription and deallocate the VM to prevent additional usage.
• Access condition: Sole administrator locked out by tenant MFA; no alternate administrator or authentication method.
• Support limitation: Portal support loops back to the inaccessible MFA prompt; cross-directory submission returns AADSTS16000.
• Tenant ID and tenant domain.
• Subscription ID, if shown on an invoice.
• Invoice numbers, dates, and charged amounts.
• Billing profile/account details and the last four card digits.
• A safe alternate email address and telephone number.
• Date access was lost and the date cancellation was first attempted.
• Refund request: Ask for review of charges incurred after the documented lockout and first cancellation attempt.

Do not post invoices, payment details, tenant identifiers, or contact details publicly. Supply them only through the private support case and ownership-verification process.

Cancellation stops Azure subscription billing immediately, although a final invoice can still include usage incurred before cancellation. Services are disabled after cancellation, including deallocation of virtual machines; retained data is not billed during the temporary retention period.^2^

A refund is separate from cancellation and is not automatic. Ask the billing engineer to record the lockout timeline and make an explicit refund or billing-adjustment determination.

Suggested case text:

Sole administrator MFA lockout — urgent subscription cancellation and billing review

I am the sole administrator of an Azure pay-as-you-go tenant and cannot complete tenant MFA. There is no alternate administrator. The Azure support portal requires the same unavailable MFA, and attempting support from another directory returns AADSTS16000.

Please immediately cancel subscription [subscription ID], stop/deallocate its resources, and confirm the effective cancellation time. Please also review charges incurred after [date access was lost / first cancellation attempt] for refund or billing adjustment.

Separately, please open a Data Protection/Admin Account Recovery case for the locked tenant. Ownership evidence, invoices, and payment verification can be provided privately.

2. Request tenant recovery separately

Ask the billing agent to create or route a case to the Data Protection team for Admin Account Recovery/MFA reset. Closely matching sole-admin Azure lockouts—including cases with continuing charges—were handled through a support ticket followed by Data Protection contacting the tenant owner by email or telephone.^3^^4^

Use precise wording:

“The only Global Administrator is blocked by tenant MFA. No administrator can re-register authentication methods. Please open a Data Protection/Admin Account Recovery case and contact me through the alternate details in this case.”

A Microsoft Q&A moderator cannot reset MFA directly, but a matched Q&A case can be escalated to Data Protection. If using Q&A for escalation, include only the symptoms and case number publicly; provide identifying information only through a moderator’s private-message mechanism.^5^

3. Protect the still-accessible personal Microsoft account

Unexpected foreign sign-in prompts indicate attempted access but do not, by themselves, prove that the password was obtained. Because the personal Microsoft account still works:

1. Run a full malware scan on devices used for Azure sign-in.
2. Change the Microsoft-account password from a trusted device.
3. Review and correct account security information and other account settings.
4. Add another recovery/sign-in method.
5. Never approve an Authenticator request that was not initiated by you.

Microsoft recommends scanning for malware before changing the password in a suspected-compromise case.^6^

Do not remove or overwrite the tenant’s Authenticator registration while recovery is pending; the personal Microsoft account’s security methods and the Azure tenant identity’s MFA registration can be distinct.

4. After access is restored

Create at least two cloud-only emergency administrator accounts, use phishing-resistant authentication distinct from the normal administrator method, store credentials securely, and exclude those emergency accounts from Conditional Access policies that could block recovery. Microsoft recommends validating them regularly.^7^

References

1. Troubleshoot Azure subscription sign-in issues
2. Cancel and delete your Azure subscription
3. Locked out of my azure account, how to cancel services? - Microsoft Q&A
4. Locked out of Azure — MFA misconfiguration, sole administrator - Microsoft Q&A
5. Locked Out of Azure Tenant Due to MFA Issue - Microsoft Q&A
6. How to recover a hacked or compromised Microsoft account | Microsoft Support
7. Manage emergency access accounts in Microsoft Entra ID