Locked out of admin 365 account because authenticator not working

If no alternate sign-in method works and Recover your account is unavailable or cannot verify you, Microsoft must perform tenant ownership verification and reset the sole Global Administrator’s authentication methods.

1. Check the remaining self-service options

1. Start signing in with your Microsoft 365 administrator account.
2. At the Authenticator prompt, select Other ways to sign in or Sign in another way.
3. Use any previously registered method shown, such as a phone call, SMS, security key, or another authenticator device. Microsoft specifically recommends trying Other verification options when the current method is unavailable.^1^
4. If the page displays Recover your account, select it and complete the identity-verification process. This option appears only when your organization previously configured Microsoft Entra account recovery with an external identity-proofing provider.^2^

If neither option is available, there is no self-service administrative reset: the only Global Administrator cannot enter the tenant to remove their own unusable method.

2. Request sole-admin tenant recovery

Contact Microsoft business support, not Microsoft consumer account support, using the Microsoft admin-support numbers for your country or region.^3^

When speaking to the automated system or agent, state:

This is a Microsoft 365 business tenant. I am the sole Global Administrator, all registered MFA methods are unusable, and no other administrator can reset them. I need a service request for the affected tenant transferred to the Data Protection or tenant-recovery team for ownership verification and an authentication-method reset.

Be ready to provide privately to Microsoft Support:

• Tenant or primary Microsoft 365 domain name
• Administrator sign-in name
• Company and subscription details
• Billing information
• A working alternate email address and phone number
• Domain-ownership or DNS verification, if requested

The matching sole-admin recovery guidance identifies Microsoft’s Data Protection team as the team authorized to verify ownership and restore access when no other administrator can reset MFA.^4^

Do not publish tenant, billing, or identity-verification details in this public forum.

3. If phone support cannot open the case

A documented workaround from matching Microsoft Q&A cases is to create a separate Microsoft 365 trial tenant, sign in to that tenant’s admin center, and select Help & support. Ask the agent to:

1. Open the ticket on behalf of the locked tenant, not the trial tenant.
2. Record that there is no accessible second Global Administrator.
3. Transfer the case to the Data Protection team for tenant ownership verification and MFA recovery.^5^

If a paid trial is created, cancel it afterward to avoid future charges.

After access is restored

1. Re-register Microsoft Authenticator and add at least one additional strong authentication method.
2. Create two or more dedicated emergency-access (“break-glass”) accounts and monitor them. Microsoft recommends these accounts specifically to prevent loss of administrative access when administrators’ MFA devices or services are unavailable.^6^
3. Do not rely on Authenticator backup alone: work or school credentials are not backed up; only the account name is restored, and the account must be registered again.^7^

References

1. You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
2. Perform account recovery in Microsoft Entra ID
3. [Personal account](https://support.microsoft.com/support/#microsoft-sales-support)
4. Sole Global Admin locked out of Microsoft 365 tenant - lost Authenticator MFA - Microsoft Q&A
5. How to access global admin 365 account if locked out - authenticator not working! - Microsoft Q&A
6. Manage emergency access accounts in Microsoft Entra ID
7. [iOS](https://support.microsoft.com/authenticator/restore-account-credentials-from-microsoft-authenticator#unable-to-restore-authenticator-account-credentials)