Sole Global Administrator locked out due to unavailable MFA – no other admin in Microsoft 365 tenant

Question

Sole Global Administrator locked out due to unavailable MFA – no other admin in Microsoft 365 tenant

Nattawut Aunjangwang 20

We have a Microsoft 365 business tenant where the sole Global Administrator can no longer complete MFA.

The username and password are correct, but the Microsoft Authenticator registration associated with the Global Administrator is no longer available. The registered recovery phone number and alternate email are also no longer accessible.

We have confirmed the following:

The affected account is the only known Global Administrator.

Other user accounts in the same tenant can still sign in, but they are standard Member accounts with no assigned administrative roles.

We checked Microsoft Entra Privileged Identity Management, and the accessible account has no eligible administrative role assignments.

Therefore, no existing user can reset the Global Administrator's authentication methods or assign another Global Administrator.

Self-service account recovery cannot be completed because the registered verification methods are unavailable.

A Microsoft support case has already been opened and escalated to the Data Protection team for tenant ownership verification and MFA recovery.

While waiting for the Data Protection team, I would like to confirm:

Is Data Protection/Tenant Recovery the correct Microsoft escalation path for this scenario?

Is there any supported method for an existing non-admin Member account in the same tenant to assist with recovery of the sole Global Administrator?

What tenant ownership verification information should we prepare to help expedite the recovery?

After ownership verification, can Microsoft reset/remove the existing authentication methods so that the Global Administrator can register Microsoft Authenticator again?

We can provide Microsoft Support with billing records, previous Microsoft invoices, company information, domain ownership information, and access to an existing Member account within the affected tenant if required.

Thank you for any guidance.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hi @Nattawut Aunjangwang

Please note that this is a user-to-user support forum, and I’m not a Microsoft Support representative. I don’t have access to Microsoft’s internal systems or your support case, so I can only provide guidance based on publicly available information and similar cases.

Based on my research, your current approach appears appropriate for this situation:

1.When the only Global Administrator has lost access to all registered MFA and recovery methods, Microsoft Support is generally required to assist with tenant ownership verification and account recovery. The Data Protection team may be involved in this process.

2.A standard Member account cannot reset the Global Administrator's authentication methods or assign administrative roles. Therefore, continuing with Microsoft Support is the appropriate path.

3.To help with the verification process, you can prepare information such as:

-Tenant ID and tenant name

-Affected Global Administrator account

-Organization/business information

-Custom domain and domain ownership information

-Microsoft subscription/billing information, such as previous invoices

-Any additional information requested by Microsoft Support

Please provide sensitive information only through the official support channel.

4.After ownership verification, Microsoft Support can assist with the account recovery process and help regain access to the Global Administrator account. The specific recovery actions, including MFA handling, will depend on Microsoft's recovery process.

Since you already have a case with the Data Protection team, I recommend continuing to work with Microsoft Support through that case.

I hope this information helps.