Unable to complete MFA verification – Error Code 399287 – Global Administrator account

Thank you for the detailed explanation.

I confirm that I am the only Global Administrator of the Microsoft Entra tenant, and there are no other administrators who can reset my MFA methods.

The phone number is correct, but SMS/voice verification consistently fails with error 399287. I also do not have any alternative authentication method available to access the administrator account.

Therefore, this is an administrator lockout scenario.

I understand that the issue may be related to Microsoft’s security/risk systems blocking the phone-based verification method.

I will contact Microsoft Support as recommended. However, before doing so, could you please confirm that the appropriate request is:

Global Administrator account recovery + MFA reset/re-registration due to error 399287, with tenant ownership verification.

If there are any specific details or documents I should prepare for the Data Protection team to verify tenant ownership, please let me know.

Thank you for your assistance.

Hello,

I am the only administrator (Global Administrator) of our Microsoft Entra tenant, and I am currently locked out of the administrator account.

The problem occurs during MFA verification. Phone-based verification (SMS/voice call) fails with error code 399287.

I have confirmed that the phone number is correct, but the verification still fails. I do not have another administrator in the tenant who could reset my MFA methods, and I do not have another available authentication method to access the account.

I understand that this may be an administrator lockout caused by Microsoft’s security/risk system blocking the phone-based verification method.

I need assistance with:

Recovering access to the Global Administrator account

Resetting/re-registering MFA

Restoring access to the Microsoft Entra tenant

I am ready to provide any information or documentation required to verify ownership of the tenant.

Please escalate this request to the appropriate team (Data Protection / tenant administrator recovery team) if necessary.

Issue: Microsoft Entra Global Administrator lockout Error code: 399287 Authentication method: SMS / voice call Other administrators: None — I am the only administrator Request: Tenant administrator account recovery and MFA reset

Please let me know what information you need from me to verify tenant ownership and proceed with the recovery.

Thank you.

Hi @Admin Tenant

As far as I know, error 399287 typically indicates that the phone-based verification method (SMS or voice call) has been blocked at the Microsoft platform level. This can occur when a phone number or authentication request is flagged by Microsoft's security and risk detection systems. In such scenarios, verification attempts may continue to fail even when the phone number itself is correct.

If there is another administrator in your tenant, they can usually help restore access much more quickly by resetting your MFA methods or requiring MFA re-registration. Your administrator can follow the guidance provided here: Manage authentication methods for Microsoft Entra multi-factor authentication

However, if you are the only administrator in the tenant and no alternative authentication methods are available, this becomes an administrator lockout scenario. In that situation, the supported recovery path is to contact Microsoft Support and request assistance with tenant administrator account recovery or an MFA reset. The appropriate support team will need to verify tenant ownership before any changes can be made to the account.

Please locate the Microsoft Support phone number for your region and contact them directly: Customer service phone numbers - Microsoft Support 

(Depending on your country or region, when you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)     

In some regions, the initial interaction may be handled entirely by an automated system. To help you prepare, below is an example of the questions you may receive and the recommended responses: 

What kind of problem are you experiencing? 

Answer: Authenticator 

What product are you using? 

Answer: Office 365 for business 

Is this for an education or company account? 

Answer: For companies 

Are you an administrator? 

Answer: Yes 

Are there any other administrators in your organization? 

Answer: No. I am the only administrator in the tenant. 

Do you need a Service Request? 

Answer: Yes. I need to open a support ticket. Please transfer me to the Data Protection team. 

Please note that this team is always overwhelmed, so you might need to wait for them to call you, this should take 3-10 working days. 

I hope this information helps you successfully escalate your request and regain access to your tenant. If you have any updates or additional questions, please feel free to reply to this thread. I will be happy to continue assisting you.