Sole Global Administrator Locked Out – Microsoft 365 Developer Legacy Sandbox – MFA Error 399287

Aryo Trikarsono 0 Reputation points
2026-11-12T11:05:41.1033333+00:00

Hello Microsoft Support Team,

I am the sole Global Administrator of a Microsoft 365 Developer Program tenant, and I am unable to access the Microsoft 365 Admin Center due to an MFA verification failure.

Tenant information:

Tenant domain: 1lff8.onmicrosoft.com

Subscription: Microsoft 365 Developer E5 – Legacy Sandbox

Administrator: Sole Global Administrator

Registered MFA method: SMS only

Country: Indonesia (+62)

Problem description:

My administrator username and password are accepted successfully.

However, when Microsoft requests SMS verification during sign-in, I receive:

Error Code: 399287

The phone number is working correctly and can receive Microsoft MFA SMS verification codes for my other Microsoft Developer accounts.

I have also enabled diagnostic flagging and retried the authentication process, but the error persists.

Current situation:

I am the only Global Administrator of this tenant.

No alternative MFA method is registered.

There is no second administrator who can reset my authentication methods.

I can still access Microsoft 365 applications such as Outlook and Copilot through an existing session.

However, accessing admin.microsoft.com always triggers the MFA error.

My Developer Program dashboard remains accessible and shows the tenant status as LEGACY SANDBOX, with approximately 59 days remaining in the current subscription period.

Request for assistance:

Could a Microsoft moderator please help escalate this case to the Microsoft Entra ID Data Protection / Tenant Recovery team?

Specifically, I need assistance with:

Reviewing the 399287 / BadReputation restriction affecting my SMS authentication.

Requesting backend investigation and removal of the phone reputation block if confirmed.

Recovering access to my sole Global Administrator account.

Re-registering a secure MFA method after account recovery.

I can provide the Tenant ID, administrator UPN, Request ID, Correlation ID, timestamp, phone number, and proof of tenant ownership through a secure private channel.

I would appreciate guidance on the appropriate recovery process.

Thank you for your assistance.

Microsoft 365 and Office | Development | Microsoft 365 Developer Program
0 comments

2 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-11-12T11:07:23.43+00:00

    Contact Microsoft 365 business phone support and request a case routed to the Data Protection/Tenant Recovery team for sole-administrator MFA recovery and review of SMS error 399287; this requires Microsoft-side identity verification because no other administrator or authentication method is available.

    Open the recovery case

    1. Use the current Microsoft global customer-service phone-number list referenced on the Microsoft 365 support page. Phone technical support is available in English 24/7, although regional and local-language availability varies.^1^
    2. In the automated menu, identify the issue as:
      • Office 365 for business
      • Authenticator/MFA
      • Administrator: Yes
      • Other administrators: No
      • Create a support request: Yes
    3. Tell the agent:

      I am the sole Global Administrator of a Microsoft 365 Developer E5 Legacy Sandbox tenant. My password is accepted, but the only registered MFA method, SMS, fails with error 399287. There is no alternate authentication method or second administrator. Please create a tenant-recovery case and route it to the Microsoft Data Protection team for identity verification, MFA recovery, and review of the SMS phone-reputation restriction.

    This is the recovery route recommended in a matching sole-administrator 399287 case. Q&A community members and ordinary moderators cannot themselves modify the tenant, reset MFA, or unblock SMS; the Data Protection team has the recovery process needed for a locked-out administrator.^2^

    Information to prepare

    Provide these details only through the support case or a moderator-initiated private message, not in the public Q&A thread:

    • Tenant ID and tenant domain
    • Affected administrator UPN
    • Full telephone number and country code
    • Error code 399287
    • Request ID, correlation ID, and exact UTC timestamp
    • Developer subscription type and dashboard expiration date
    • Alternate email and telephone number
    • Any ownership, subscription, or domain-verification information requested

    Closely matched cases were resolved after these details were supplied privately and engineering removed the backend bad-reputation restriction.^3^ That outcome supports requesting the review, but only Microsoft can confirm whether the same restriction applies to this number.

    Do not continue making frequent SMS requests while the case is pending. Microsoft documents that repeated attempts can trigger or extend temporary protection blocks.^4^

    Protect the remaining legacy-sandbox window

    The Legacy Sandbox status is a separate, time-sensitive issue. Microsoft is retiring these subscriptions:

    • The final renewal lasts 60 days.
    • At expiration, the tenant becomes read-only for 30 days.
    • After that, the subscription and data are permanently deleted.
    • A legacy subscription cannot be extended, converted, or transferred.^5^

    Because approximately 59 days remain:

    • Preserve the existing Outlook/Copilot sessions; do not sign out unnecessarily.
    • Export any data or configuration those sessions currently let you access.
    • After admin access is restored, immediately export app registrations, code/configuration references, Power Platform solutions, files, mail, users, groups, and tenant settings that must be retained.
    • If the Developer Program dashboard offers a new sandbox and eligibility is satisfied, provision it early. It will be a separate tenant, and nothing transfers automatically.^5^

    After access is restored

    1. Register Microsoft Authenticator or another permitted strong method before removing SMS.
    2. Add at least one additional administrator so recovery does not depend on one account.
    3. Create two cloud-only emergency-access accounts with independent, phishing-resistant credentials.
    4. Store their credentials securely, monitor their use, and test them regularly.

    Microsoft recommends two or more emergency-access accounts specifically to prevent complete administrative lockout during MFA or telecommunications failures.^6^

    References

    1. Get support - Microsoft 365 admin | Microsoft Learn
    2. Sole global administrator locked out – SMS MFA blocked (error 399287) - Microsoft Q&A
    3. Sole global administrator locked out - MFA SMS blocked (error 399287) - Microsoft Q&A
    4. Common problems with two-step verification for a work or school account
    5. Retirement of Microsoft 365 Legacy developer subscriptions
    6. Manage emergency access accounts in Microsoft Entra ID
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. Roebe Ta 1,840 Reputation points Independent Advisor
    2026-11-12T11:58:17.8666667+00:00

    Hello @Aryo Trikarsono ,

    I'm sorry to hear that the only admin account is locked out.

    First of all, I would like to clarify one point: this forum is intended for users to assist one another. No one, including myself, has the authority or the tools to recover admin access on your behalf.

    I also cannot escalate your case to the Data Protection / Tenant Recovery team on your behalf. To protect your organization's security and privacy, Microsoft requires the tenant owner or an authorized representative to initiate the recovery process directly and provide the necessary verification information.

    To help, I'd like to share the prompt that has successfully helped many other users reach the Data Protection Team and create a support request:

    1. Find the related hotline number for your country to call the frontline and let them raise a ticket for you (chooé Work account tab): Customer service phone numbers - Microsoft Support

    2. Depending on your country or region:

    For some countries, when calling the support number, although there are about 30 seconds opening as something "you can visit the link...." But you can ignore this opening and wait until the option, then "1" as a business email user, "1" again for technical help.

    For some countries, it will be an automated conversation like:

    • First, when you call the hotline, it asks what kind of problem you are worried about.
    • Answered: authenticator.
    • A: What kind of product are you using?
    • B: Microsoft 365 for business.
    • A confirmation: education or company account?
    • B: For companies
    • A: Are you an administrator?
    • B: Yes.
    • A: Do you have the other admin in your organization?
    • B: No.
    • A: You need one.... Service request?
    • B: Yes

    Important note:

    • You may need to call multiple times before you are connected to a live support representative and can successfully create a support request with a ticket number for tracking. 
    • If calling the support line in your region is difficult, you may try another regional support number that offers service in your language, or contact the English support line if you’re comfortable speaking English. 
    • If your subscription is from a partner or reseller, contact the reseller's support provider to help open a service request on behalf of you instead.   

    If you encounter any trouble using the phone support, please feel free to let me know.

    Kind Regards.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.