Locked out of the global admin account

If you recently changed your phone or reinstalled Microsoft Authenticator, Microsoft may not yet recognize the new app as a trusted authentication method. As a result, you may be unable to sign in.

1.      If you still have your old device, try approving the sign-in request from that device.

2.      Check whether another verification method is available, such as email.

3.      Ask another administrator in your organization to reset your account or authentication methods.

4.      If your Microsoft 365 subscription was purchased through a reseller, ask whether the reseller can use delegated administration to help reset the account.

5.      If you are the only administrator and have no other way to sign in, contact Microsoft Support and request tenant recovery through the Data Protection team.

If every administrator is locked out

Use Microsoft’s tenant recovery process, often referred to as a Data Protection request. Support will verify that your company owns the tenant before helping restore access to the Global Administrator account.

1.      Open a support case from a Microsoft 365 tenant that you can access, such as another tenant or a trial tenant. In the Microsoft 365 admin centre, go to Help & support and state: “Sole Global Administrator locked out; requesting tenant recovery for a different tenant.” Make it clear from the beginning that the case concerns another tenant.

2.      Prepare the locked tenant’s tenant ID, domain name, former administrator’s user principal name (UPN), and company registration documents. The tenant ID may be available from the OpenID configuration address already provided above.

3.      Be prepared to verify ownership of the domain. Support may ask you to add a specific DNS TXT record. After verification, they can guide you through resetting the administrator’s password and multifactor authentication.

4.      If phone support is the only available option, ask specifically for “tenant recovery” and the “Data Protection team.” Use a clear phone line and speak slowly when responding to the automated Interactive Voice Response system.

Suggested IVR responses

Problem: Authenticator Product: Office 365 for business Account type: Company or education account, as applicable Are you an administrator? Yes Is another administrator available? No Do you need a service request? Yes

Microsoft customer service phone numbers: https://support.microsoft.com/en-us/topic/customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2

Once access is restored, create a second Global Administrator account and a separate emergency access account so that the organization is not locked out again if one device or authentication method becomes unavailable.

Hi Tim,

Thank you for sharing the details of your situation. 

Since you have already contacted Microsoft Support but were unable to reach the appropriate recovery team, I recommend trying to contact Microsoft Support again using the prompts below to navigate the automated system. Several users who experienced similar tenant lockout situations have reported that this approach helped them get past the automated system and reach the appropriate support team. 

• Please try locating the appropriate hotline for your region here: Customer service phone numbers - Microsoft Support  
• 

In this situation, the Microsoft Data Protection team has tools and processes in place to verify identity and regain access to administrator accounts.  

Here are some tips and an example of a prompt to help you navigate the IVR more effectively:  

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)    

In some regions, the initial interaction may be automated, so here’s a general idea of how the conversation might go to help you prepare:      

• What kind of problem are you experiencing?         
• Answer: Authenticator      
• What products do you use?         
• Answer: Office 365 for business         
• Is this for an education or company account?         
• Answer: For companies         
• Are you an administrator?         
• Answer: Yes         
• Are there any other administrators in your organization?         
• Answer: No. I am the only admin in my tenant          
• Do you need a... Service request?          
• Answer: Yes. I need to create a ticket. Please send me direct to the Data Protection Team.      

When reaching out to the Data Protection team, please be prepared to provide any requested information, such as: 

• Tenant name/domain 
• Affected administrator account 
• Microsoft 365 subscription details 
• Proof of tenant/domain ownership, if required 
• Billing or subscription-related verification information 
• Any organizational documents requested by the recovery team 

I also recommend calling during business hours. In my experience, it can be difficult to get through to the correct support queue, and automated systems don't always work as expected. If you can't get through on your first try, I suggest trying again later or at a different time. 

I hope these steps help you create a support ticket successfully and move closer to regaining access to your administrator account. While I’m not able to intervene directly, guiding you to the right support team is the most effective help I can provide here.  

Hope you're able to get this resolved soon. 

If the answer is helpful, please click "Yes" and kindly upvote it. If you have any extra questions about this answer, please click "Comment".             

Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.