Unable to complete sign-in process

Question

Unable to complete sign-in process

administrator 0

We are locked out of our Microsoft 365 tenant. We have only one Global Administrator. The administrator's password works, but MFA approval notifications are not being received after Microsoft Authenticator was reinstalled. We need tenant ownership verification and MFA recovery for the sole Global Administrator.

Moderator's note: Moved from Microsoft Security | Microsoft Authenticator

0 comments

2 answers

Your answer

Answer 1

Hi @administrator,

As this is a user-to-user support forum, community members here do not have the permissions or tools required to verify tenant ownership, reset MFA methods, or restore access to a Global Administrator account.

In this situation, the Microsoft Data Protection team has specialized tools and processes in place to verify tenant ownership and help eligible customers regain access to administrator accounts.

The best next step is to contact Microsoft Support by phone so that the frontline support team can create a support case and route it to the Data Protection team for further assistance. You can find the appropriate support number for your region here: Contact Microsoft Customer Support

User's image

Here are some tips and an example of a prompt to help you navigate the IVR more effectively:

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)

In some regions, the initial interaction may be automated, so here’s a general idea of how the conversation might go to help you prepare:

What kind of problem are you experiencing?
Answer: Authenticator
What products do you use?
Answer: Office 365 for business
Is this for an education or company account?
Answer: For companies
Are you an administrator?
Answer: Yes
Are there any other administrators in your organization?
Answer: No. I am the only admin in my tenant
Do you need a... Service request?
Answer: Yes. I need to create a ticket. Please send me direct to the Data Protection Teams.

During the phone call, you will need to provide the information associated with your subscription, such as your company name, billing details, phone number, and an alternate email address, etc. This information allows the Data Protection team to verify your identity and securely assist you in regaining access to your administrator account.

I hope this helps point you to the right team to regain access to your tenant as quickly as possible. Thank you for your understanding.

Answer 2

Because the only Global Administrator cannot complete MFA, contact Microsoft Support by phone and request Microsoft Entra tenant-lockout recovery with ownership verification and MFA re-registration for the designated Global Administrator. Microsoft’s documented process is to verify tenant ownership and restore access to the existing tenant—not create a replacement tenant.^1^

Open the recovery case

Use Microsoft’s business-support contact list and call the number for your country or region.^2^
Describe the case precisely:

Microsoft 365 business tenant lockout. The affected account is the sole Global Administrator. The password is accepted, but MFA cannot be completed after Microsoft Authenticator was reinstalled. No administrator is available to reset the authentication methods. We need tenant-ownership verification and recovery of the existing tenant.
Ask the agent to create a case against the locked tenant and route it to the team handling Data Protection/tenant recovery. Matching sole-administrator MFA-lockout cases require this escalation.^3^
Record the support case number and provide a reachable external email address and telephone number.

Prepare the following without posting it publicly:

Tenant’s *.onmicrosoft.com name and tenant ID, if known
Affected Global Administrator username
Custom domain name and ability to modify its DNS records
Subscription details, invoices, and billing information
Registered organization information
An external contact email and telephone number

Microsoft uses a high-assurance verification process before recovering the designated administrator’s access.^1^

Faster paths if available

Another sign-in method appears: Select Other verification options and use a previously registered method. This only applies if another method is actually offered.^4^
A Microsoft partner manages the tenant through active GDAP: Ask that partner to check its active roles. A partner with the appropriate authentication-reset role can restore access; one with Service Support Administrator can submit the recovery request on your behalf. Microsoft’s Data Protection team will still work directly with your organization for verification.^5^
Telephone support cannot create the case: As a workaround, create a temporary Microsoft 365 trial tenant, sign in to its admin center, then go to Support → Help & Support → Contact support. State that the ticket concerns a different, locked tenant and request Data Protection/tenant recovery. Cancel the trial after the recovery case is resolved to avoid renewal charges.^6^

After access is restored

Re-register the administrator’s authentication methods.
Create administrative redundancy. Microsoft recommends two cloud-only emergency-access accounts permanently assigned the Global Administrator role.^7^
Give those accounts distinct credentials and authentication methods, monitor their sign-ins, and document the emergency-access procedure.^5^

Do not publish tenant identifiers, invoices, administrator addresses, or ownership documents in this Q&A thread; provide them only through the Microsoft support case.

References