Request for Assistance – MFA Lockout and Account Recovery

Question

Request for Assistance – MFA Lockout and Account Recovery

John Doe Customer 20

I am locked out due to missing Authenticator access and cannot open a support case or access the admin center. My organization is just myself with this one account, so it is a tenant lockout. Initial post: https://answers.microsoft.com/en-us/msoffice/forum/all/how-to-recover-account-access-when-authenticator/8556a5ad-678c-45e2-8f01-32f588db34d8

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Marcelo Gomez 5 Reputation points

2025-05-15T02:50:41.1733333+00:00

John, en la documentación de Microsoft siempre indica que es bueno tener una BreakGlassAccount para estos casos. Lo que yo hago con mis clientes es generar un usuario con el rol de "Conditional Access Administrator" y a ese usuario especifico excluyo de todas las políticas de MFA y le genero una contraseña bastante segura y que se guarde en un lugar seguro, de esta manera, en caso de un lockout por culpa de un MFA mal configurado, el usuario de BreakGlassAccount siempre tendrá la posibilidad de deshabilitar la política que esta causando el problema y volver a tener acceso.
John Doe Customer 20 Reputation points

2025-05-15T03:43:11.5433333+00:00

Thanks for the info. I just tried to do that but I can't use conditional access on the free Entra ID plan so I made a backup global admin account that has email and phone 2FA. Looks like it'll be required to use Authenticator eventually though.

Answer accepted by question author

0 additional answers

Marcelo Gomez 5 Reputation points

2025-05-15T02:50:41.1733333+00:00

John, en la documentación de Microsoft siempre indica que es bueno tener una BreakGlassAccount para estos casos. Lo que yo hago con mis clientes es generar un usuario con el rol de "Conditional Access Administrator" y a ese usuario especifico excluyo de todas las políticas de MFA y le genero una contraseña bastante segura y que se guarde en un lugar seguro, de esta manera, en caso de un lockout por culpa de un MFA mal configurado, el usuario de BreakGlassAccount siempre tendrá la posibilidad de deshabilitar la política que esta causando el problema y volver a tener acceso.
John Doe Customer 20 Reputation points

2025-05-15T03:43:11.5433333+00:00

Thanks for the info. I just tried to do that but I can't use conditional access on the free Entra ID plan so I made a backup global admin account that has email and phone 2FA. Looks like it'll be required to use Authenticator eventually though.

Answer 1

Harshitha Eligeti 4,530 Microsoft External Staff Moderator

Hello @John Doe Customer

Thank you for sharing required details over email.

The issue pertains to a tenant lockout, where no other global admin in the tenant has the necessary permissions to re-register MFA.

To resolve this, we have engaged our Data Protection team through a support ticket. They will reach out to you via email or phone to help restore access to the tenant and assist in resolving the issue.

Once the issue has been resolved by our support team, please feel free to revisit and kindly click "Accept Answer," as this will be helpful to other community members facing similar issues.

John Doe Customer 20 Reputation points

2025-05-14T21:13:59.59+00:00

Redacted
John Doe Customer 20 Reputation points

2025-05-14T21:15:53.77+00:00

Redacted
Raja Pothuraju 47,820 Reputation points Microsoft Employee Moderator

2025-05-14T23:34:59.2833333+00:00

Hello @John Doe Customer,

I just reviewed the support ticket and noticed that a support engineer from the Data Protection team had a call with you a few minutes ago. The engineer has raised an internal request for approval to make the necessary changes to your tenant.

Once the request is approved and the changes are completed, the engineer will notify you. After that, you should be able to regain access to your tenant.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.