Sole Global Admin Locked Out by MFA – Error 500121

Dear @Enzo Louis Laparan,

Good day! Welcome to Microsoft Q&A forum!

Based on your description, this error usually appears when the sign‑in process requires Multi‑Factor Authentication (MFA), but the MFA setup or verification wasn’t fully completed. In most cases, this happens when MFA hasn’t been set up yet, or the user started the setup but didn’t finish all the required steps.

For reference: How to troubleshoot Microsoft Entra sign-in errors

Please note that I have no control over user accounts, especially when it comes to logging in to your account, resetting your password, changing your access, etc. 

Because you are the sole administrator in your organization, you need to contact Microsoft's Data Protection Team. You can refer to Bence's answer for tips on making calls to bypass the AI system.

If you experience difficulties in placing a call, alternatively, you may create a new trial tenant account and submit your request from there.

To set up a new tenant, please follow these steps: 

• Visit Compare Office 365 Enterprise Pricing and Plans | Microsoft 365, choose any plan and click try for free to start a free trial.    
• Follow the guided setup process to create a new account for a new tenant.

Once your tenant is created, you should be able to access the support portal and submit your ticket referencing your locked account without further issues.

In the ticket's description, you could refer to this message:

"Hello,

I am currently locked out of my Microsoft 365 tenant because multi-factor authentication is enforced, and I am unable to complete the verification process. I am the only global administrator for this tenant, which means I cannot access my account or the Microsoft 365 Admin Center.

To resolve this, I have created a new tenant and would like to be connected with the Data Protection Team to verify my identity and assist with regaining access. I am available to provide any required documentation or verification to support the recovery process."

Ticket Support: Log in the Microsoft 365 Admin Center using the newly created trial admin account (not the currently locked one) > Support > Help & Support. You can raise support ticket at: https://admin.microsoft.com/#/support/requests

When you open a support ticket, please make sure to turn off the Support Assistant (AI) in the help panel.

Several customers have reported issues when the Support Assistant is turned on the system sometimes fails to display the “Contact Support” option.

As shown in the screenshot, simply switch Support Assistant > Off, then type your issue description. Once the AI is off, the “Contact Support” button will appear normally, allowing you to submit a ticket directly.

• After clicking on "Help & Support" button, you can type "I need agent support via phone or email". After that, you can click on "Contact support" 
• Choose contact method: "Phone" 
• Fill all the information in this contact support details, please describe your situation carefully so they will have enough information to help you. 
• Finally, click on "Contact me"
• After completing them, you will receive an email appointment for a meeting to review this issue professionally together. 
• For more details, you could refer to this article: Get support for Microsoft 365 for business 
• This new trial tenant will not give you access to any of the data or settings in your original locked tenant. It is solely a temporary means to contact Microsoft support.   
• Be prepared for Microsoft support to ask for verification of your identity and administrative rights for the locked tenant.   
• The resolution time might be longer as you are contacting support from a different tenant.   
• Remember to cancel the trial subscription for the new tenant once your issue with the original account is resolved to avoid any unintended charges. You can typically do this within the Microsoft 365 Admin Center under "Billing" > "Your products."

Kindly let me know when there are updates or if you need further assistance. Any updates you’re able to share would be really helpful.

I'm here and happy to help! Thank you for your kindness and patience! 

If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in [forum documentation] to enable e-mail notifications if you want to receive the related email notification for this thread.

Dear @Enzo Louis Laparan

f there is no other Global Administrator available in the tenant, this needs to go through Microsoft's tenant recovery process.

I would recommend contacting Microsoft Support and explicitly describing this as a tenant lockout / no accessible Global Administrator case.

You can start here:

Microsoft Entra – Get support

If you prefer to call Microsoft Support, the exact phone menu depends on your country or region. In some countries, there is an initial message telling you to visit the online support page. You can simply wait for the menu options.

In other countries, the call may be handled by an automated conversation. For example:

1. What kind of problem are you concerned about?
   1. Authenticator
2. What kind of product are you using?
   1. Office 365 for business/Azure portal/Entra ID
3. Is this an education or company account?
   1. Company
4. Are you an administrator?
   1. Yes
5. Do you have another administrator in your organization?
   1. No
6. You need to create a service request?
   1. Yes

The exact wording may differ depending on the country and the current phone system, but the important part is to get the call converted into a support/service request.

Once you reach a support engineer, I would be very explicit:

“This is a Microsoft Entra tenant lockout. The only Global Administrator account is no longer accessible, and there are no other Global Administrators in the tenant. We need to recover administrative access to the tenant. Please escalate this case to the Data Protection / Tenant Recovery team.”

Have the following information ready for the ownership verification:

• Tenant ID
• Initial *.onmicrosoft.com domain
• Custom domain name(s)
• Proof of domain ownership / DNS access
• Microsoft 365 subscription and billing information
• Company information
• Details about the previous Global Administrator
• Any other information Microsoft requests to verify ownership

For future protection, I would also recommend having at least two independently managed Global Administrator accounts and dedicated emergency access accounts. This prevents losing access to the entire tenant when a single administrator account becomes unavailable.