Authenticator Lockout Loop

Lucas de Nooy 0 Reputation points
2026-11-12T16:13:00.19+00:00

I have a new iPhone, and I thought all my 365 logins had transferred over to my new iPhone. I run my own business, and it appears that my business email did not transfer over. I have my username and password, but I do not have access to my authenticator as I have sold the old device. Every time I try and log in, it asks me to either approve a number on my authenticator device, or I need to input a one-time code sent to my authenticator device. I do not have my authenticator set up on this phone, and in order to sign in to set up my authenticator on my phone, I need my authenticator app.

At this time, I am the only admin. I am unable to log in because every log in attempt sends me back to authenticator which I do not have access to. I have proof of billing and that I own the domain the email is linked to, but I need help to get back into my authenticator app. I have tried calling support, but there has not been success as the AI usually cuts the call off after sending me to mfa.aka/setup

If there is anyone that is able to assist with this, I would greatly appreciate it as this has been a problem for the past couple months.

Microsoft 365 and Office | Subscription, account, billing | For business | Other
0 comments

2 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Hani-Ng 2,835 Reputation points Independent Advisor
    2026-11-12T16:29:56.14+00:00

    Hi Lucas de Nooy

    When you change to a new phone, the Microsoft Authenticator app doesn’t automatically transfer your account settings because the multi-factor authentication (MFA) configuration is linked to the specific device where it was originally set up.

    Since you are the only Global Administrator and you are completely locked out from the tenant, you can try to contact Microsoft Support via phone service number Customer service phone numbers - Microsoft Support. The agent will be able to create a ticket for you under the affected tenant and then transfer this ticket to Data Protection team who could help you to regain access.  

    When a call is made to support, the first step is to provide an automated voice response from AI, you won't be able to speak to a support representative if you don't respond appropriately here. Here's an example of a response that actually led to a support representative you can refer to:

    Q. Can you tell me if you are calling as a home user who uses a product or service at home or a business user who uses it in your business to provide the best assistance? 
A.I am a business user. 
Q. Thank you. Can you give me the details of your inquiry? 
A. Login technical support. 
Q. First of all, can you tell me which products you are inquiring about today? 
A. Microsoft 365 business Standard。 
Q. Please wait a moment, I understand Microsoft 365. Are you calling about a new case or an existing one? 
A. New. 
Q. To receive phone support, your phone number must be associated with your Microsoft 365 admin profile. To do this, go to aka.ms/m365profile. Again, it aka.ms/m365profile . This can take 48 hours. In the meantime, you can go to aka.ms/m365profile and file a case online. If you prefer, you can also text the link to the phone number you are calling. What do you think? 
A. The phone number is already linked to the link. 
Q. Can you tell me about the products in your inquiry? 
A. Microsoft 365 Business Standard. 
Q. Are you a Global Administrator? 
A. That's right. 
Q. I'm sorry. I didn't understand. Are you a global administrator for your domain? 
A. Yes, I am a global administrator for the domain. 
Q. If you have any inquiries, you can contact a Microsoft representative. Are you sure? 
A. Yes. Please. 
Q. Yes, I understand. Please wait a moment.

    This team is always overwhelmed, so you might need to wait for them to call you, this should take 3-10 working days.

    In case the phone line is not supportive, you can consider directly submitting a support request via trial tenant as a helpful workaround:     

    • Create a temporary Microsoft 365 tenant using a trial license: Go to Microsoft 365 Business Plans and Pricingand click Try for free to set up a temporary Microsoft 365 tenant with a trial license.    
    • Use this new account to sign in to the Microsoft 365 Admin Center and submit a support request on behalf of your primary (locked) account.   
    • Select the Help & support (headset) icon. If Support Assistant is enabled, turn it off > Type contact support in the search box > Select Contact support, then choose Phone or Email to submit your request.   

    This method doesn't require you to use your new account for your business. Instead, it allows you to create a temporary global administrator account so you can submit a support request, as your original global administrator account is locked out due to issues with multi-factor authentication. The trial account is free for one month. Be sure to delete it after submitting your support request to avoid any automatic renewals or charges from Microsoft.     

    For further instructions, you can follow this guide: Get support - Microsoft 365 admin | Microsoft Learn.   

    Just a quick note that this forum is a peer-to-peer community, so while members can share advice and experiences only, members do not have access to internal databases or the ability to escalate cases directly to Microsoft’s internal teams. Therefore, please kindly contact the Microsoft Support team for the most efficient help.    

    I hope this information helps.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-11-12T16:14:49.97+00:00

    Because you are the sole Microsoft 365 administrator and no longer have any registered verification method, request a Tenant Lockout / Sole Global Administrator MFA Recovery case and escalation to Microsoft’s Data Protection team through the regional business-support phone line.

    The MFA setup page cannot solve this lockout: changing security methods requires authentication, and Microsoft’s lost-phone guidance normally directs the user to their organization’s administrator—which, in this case, is the inaccessible account.^1^

    Call and request the correct escalation

    1. Open Microsoft’s official customer-support page and select the telephone number for your country or region.^2^
    2. Wait through the initial recorded message rather than following another link to the MFA setup page.
    3. Choose business and then technical support, where those menu options are offered.
    4. Use these answers with the automated system:
      • Problem: “Authenticator”
      • Product: “Office 365 for business”
      • Account type: “Company account”
      • Are you an administrator? “Yes”
      • Is there another administrator? “No, I am the only administrator”
      • Do you need a service request? “Yes”
    5. When connected to an agent, state:

      This is a Microsoft 365 tenant lockout. I am the sole Global Administrator, the registered Microsoft Authenticator device is no longer available, and I have no alternate authentication method. I need a Sole Global Administrator MFA Recovery case escalated to the Data Protection team.

    This escalation wording and IVR route match the accepted recovery procedure for the same new-phone, sole-administrator lockout scenario.^3^

    Have the following available for identity and tenant-ownership verification:

    • Admin username and tenant/domain name
    • Company name
    • Subscription and billing details
    • Domain-ownership evidence
    • A reachable telephone number
    • An alternate email address that is not inside the locked tenant

    Do not publish those details here; provide them only through the Microsoft support case.

    If phone support still disconnects

    Create a separate Microsoft 365 trial tenant solely to open the support request:

    1. Create the trial using a different, accessible account.
    2. Sign in to that trial tenant’s Microsoft 365 admin center.
    3. Open Help & Support and submit a ticket.
    4. Request the Data Protection team and identify the original tenant as a sole Global Administrator MFA lockout.
    5. Explain that the temporary tenant is only being used because the original tenant cannot authenticate.

    The trial tenant will not provide access to the original tenant; it is only an alternate channel for creating the recovery case. Cancel the trial after recovery to avoid billing.^4^

    After Microsoft restores access

    Once temporary access or an MFA reset is provided:

    1. Register Authenticator on the new iPhone.
    2. Remove the registration for the sold phone.
    3. Add at least one additional strong authentication method permitted by the tenant.
    4. Create a second appropriately protected administrator account so recovery does not depend on one person and one device.

    Microsoft recommends registering multiple authentication methods to reduce the risk of another device-loss lockout.^5^

    References

    1. Set up multifactor authentication for your Microsoft 365 account | Microsoft Support
    2. Contact Microsoft customer support
    3. Sole Global Administrator Locked Out – Lost Microsoft Authenticator Access After New Phone - Microsoft Q&A
    4. Sole Global Administrator locked out by Microsoft Authenticator – Tenant Recovery needed - Microsoft Q&A
    5. Recover user authentication methods using Microsoft Entra Backup and Recovery
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.