Unable to Login to Microsoft Admin Console

Question

Unable to Login to Microsoft Admin Console

Grolier Malaysia Admin 0

I tried to login to my Microsoft Admin Console and it prompted for MFA which I have not set up. Then I choose to verify via Text SMS to my mobile phone and I got this error

Error Code: 399287

Request Id: [Moderator note: Personally Identifiable Information removed]

Correlation Id: [Moderator note: Personally Identifiable Information removed]

Timestamp: 2026-11-13T07:42:44Z

Now I'm stuck. Please advise. Thanks.

0 comments

2 answers

Your answer

Answer 1

Hello @Grolier Malaysia Admin

Regarding to your issue, the error code "399287" typically indicates that the phone number used for SMS or voice call MFA has been temporarily blocked by Microsoft’s Phone Reputation system. This can occur after repeated verification failures or activity that is detected as unusual. As a security measure, when this block is in place, SMS and call‑based MFA verification cannot be completed, and the prompt will continue to fail even if the credentials are correct.

Regarding to your issue, if you still have another IT admin in your organization, you can ask them to help reset your MFA (require register MFA). Please refer to this aritcle: Manage user authentication options

If you're the only admin, in this situation, the Microsoft Data Protection Team has tools and processes in place to verify identity and regain access to administrator accounts. Please try to find the related hotline number to call the frontline let them raise a ticket for you: Technical or Sales support phone numbers (for Work account, scroll down to find your region's number)

In some countries, this is an automated conversation: First, when you call the hotline, they will ask you what kind of problem you are struggling with.

Answer: Lost access to Sole Global Admin Account

A: What products do you use?

B: Office 365 for business.

Verification: Education or company account?

B: For companies

A: Are you an administrator?

B: Yes.

A: Are there any other administrators in your organization?

B: No.

A: I need one.... Service request?

B: Yes

(Important Note: Sometimes, you would hear the computer-generated voice at first, please kindly wait for it to end, and if an agent is available, you would be directed to them and get your support. Depending on your country or region, when you call the support number, you may hear an introduction of about 30 seconds such as "You can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)

If you have any difficulty when contacting Microsoft Support, please get back to me. I will provide you alternative methods.

Thank you for your understanding.

Answer 2

If no alternative verification method is registered, another tenant administrator must require MFA re-registration for your account; if you are the only administrator, contact Microsoft business support for tenant-access recovery.

If another administrator can access the tenant

Ask a Global Administrator, Privileged Authentication Administrator, or appropriately authorized Authentication Administrator to:

Sign in to the Microsoft Entra admin center.
Go to Entra ID → Users.
Select your administrator account.
Select Authentication methods.
Select Require re-register MFA, and confirm.

This removes the registered phone, Authenticator, and software OATH methods and prompts you to configure MFA again at the next sign-in.^1^

After the reset:

Sign in again.
Complete the MFA registration prompt.
Register Microsoft Authenticator or another organization-approved method rather than depending solely on SMS.
Add a second permitted method as a recovery option.

If you are the only administrator

You cannot reset your own authentication methods while locked out. Contact Microsoft business support using the regional contact options and request:

Tenant access recovery / Data Protection assistance for a sole administrator locked out by MFA, error 399287.

Use the official support directory.^2^ Provide the support agent with:

Organization and subscription details
A reachable alternate email address and telephone number
Affected administrator username and tenant domain
Error code 399287
Request ID, correlation ID, and timestamp shown on the error page
Confirmation that no other administrator can reset MFA, if applicable

Do not post tenant IDs, telephone numbers, billing details, or administrator addresses publicly. Microsoft Support will need to verify tenant ownership before changing authentication access. Matching 399287 lockout cases use this same escalation path when no second administrator exists.^3^

If your organization has a Microsoft partner with an active GDAP relationship and suitable access-related permissions, contact that partner first; it might be able to restore access or create the support request on your behalf. Without another administrator or an appropriately authorized partner, the tenant’s Global Administrator must contact Microsoft Support.^4^

While arranging recovery

If the sign-in page displays Sign in another way or Other verification options, use a previously registered method. A new Authenticator installation cannot serve as an already registered method.
Avoid repeatedly requesting SMS codes. Repetitive requests can prolong a temporary verification block; Microsoft recommends trying another registered method or waiting before another attempt.^5^
Changing the password alone will not reset the MFA registration.

After access is restored, maintain at least two administrator accounts with distinct credentials and MFA methods, plus documented emergency-access arrangements, to prevent another tenant-wide lockout.^4^

References