Global Administrator locked out due to MFA setup failure (AADSTS9001026) in new Microsoft 365 tenant

Question

Global Administrator locked out due to MFA setup failure (AADSTS9001026) in new Microsoft 365 tenant

Keisuke Miyagi 0

We created a new Microsoft 365 tenant.

The initial Global Administrator account is unable to complete Microsoft Authenticator MFA setup.

When attempting to register MFA, the following error occurs and the QR code is never displayed:

AADSTS9001026:

The multiple resource request is not supported over the /organizations or tenant-specific endpoint.

We have tried:

https://aka.ms/mfasetup
https://aka.ms/mysecurityinfo
Multiple browsers and devices (PC and iPhone)

Other users can sign in, but cannot be granted admin roles.

The "Add assignment" button for Global Administrator is visible but disabled.

This results in a complete Admin Lockout situation.

Request:

How can we perform tenant-level admin recovery or MFA reset for the Global Administrator account?

Moderator: Moved from Microsoft 365 and Office | Access | For business | Other

Keisuke Miyagi 0 Reputation points

2026-01-04T12:55:06.8966667+00:00

Thank you for the response.

To clarify, this tenant has only one Global Administrator, and that account is locked out due to MFA setup failure.

There are no other Global Administrators, no Privileged Authentication Administrators, and no emergency (break-glass) accounts configured.

This is a complete Admin Lockout scenario.

Tenant-level intervention by Microsoft Support is required to reset MFA or recover the Global Administrator.

Please escalate this issue to Microsoft Support or advise how to proceed with tenant-level admin recovery.

2 answers

Your answer

Keisuke Miyagi 0 Reputation points

2026-01-04T12:55:06.8966667+00:00

Thank you for the response.

To clarify, this tenant has only one Global Administrator, and that account is locked out due to MFA setup failure.

There are no other Global Administrators, no Privileged Authentication Administrators, and no emergency (break-glass) accounts configured.

This is a complete Admin Lockout scenario.

Tenant-level intervention by Microsoft Support is required to reset MFA or recover the Global Administrator.

Please escalate this issue to Microsoft Support or advise how to proceed with tenant-level admin recovery.

Answer 1

To recover access to the Global Administrator account in your new Microsoft 365 tenant, you can follow these steps:

Contact Microsoft Support: Since you're locked out of the Global Administrator account, the best course of action is to contact Microsoft support directly. You can find the appropriate support contact for your region at Support for Business Products.
Use Another Global Admin: If there are any other Global Administrators in your organization, they can assist in resetting the MFA or recovering the account.
Privileged Authentication Administrator: If you have a Privileged Authentication Administrator role in your tenant, this role can help reset the Global Administrator's password or MFA settings.
Emergency Recovery: If you have set up emergency accounts (break-glass accounts) that are excluded from Conditional Access policies, you can use them to regain access.
Review Tenant Setup: Ensure that your tenant is set up with redundancy for Global Admin accounts to avoid lockout situations in the future. It's recommended to have at least two Global Admin accounts with distinct credentials and MFA methods.

If none of these options are available, reaching out to Microsoft support is crucial as they can provide assistance tailored to your situation.

Answer 2

Hi @Keisuke Miyagi,

Thank you for posting your valuable question on Microsoft Q&A forum.

Since the only Global admin account of this tenant is locked out, I recommend you contact Microsoft Data Protection Team as they are the only group authorized and equipped with the necessary tools and procedures to verify your identity and restore administrator access.

Please try to find the related hotline number to call the frontline and let them raise a ticket for you: Customer service phone numbers - Microsoft Support

Please carefully follow this instruction to ask for Microsoft Data Protection team support:

Depending on your country or region. For some countries, when calling the support number, although there are about 30 seconds opening as something "you can visit the link...." But you can ignore this opening and wait until the option, then "1" as a business email user, "1" again for technical help.

For some countries, it will be an automated conversation like:

First, when you call the hotline, it asks what kind of problem you are worried about.

Answered: authenticator.

A: What kind of product are you using?

B: Office 365 for business.

A confirmation: education or company account?

B: For companies

A: Are you an administrator?

B: Yes.

A: Do you have the other admin in your organization?

B: No.

A: You need one.... Service request?

B: Yes

If your organization's Office 365 Business/Education subscription is from a partner or reseller, and the global administrator is unable to open a service request on your end, contact the reseller's support provider to help open a service request on behalf of you instead.

Please understand that forum moderators have no control over user accounts, especially when it comes to logging in to your account, resetting your password, changing your access, etc.

If you experience issues when contacting frontline support, please let me know. Thank you and wish you have a nice day!

If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.