Sole Microsoft 365 Global Administrator locked out by MFA loop – tenant recovery needed

Question

Sole Microsoft 365 Global Administrator locked out by MFA loop – tenant recovery needed

james Warren 0

I am the sole Global Administrator of a Microsoft 365 business tenant. I know the administrator username and password, and Microsoft accepts them, but I cannot complete multifactor authentication.

Microsoft Authenticator was restored on my iPhone. The work account now shows “Sign in to add your account.” When I attempt to sign in, Microsoft requires approval from that same Authenticator registration, creating a circular MFA prompt.

The “I can’t use my Microsoft Authenticator app right now” option only offers:

Approve a request in Microsoft Authenticator
Use a verification code

Neither method is usable. No SMS, telephone, email, security key, Temporary Access Pass, or other alternative authentication method is available. There is no other Global Administrator in the tenant who can reset my authentication methods.

I still control the company domain and DNS, retain access to the administrator mailbox through an existing mail client session, and can provide subscription, billing, company, and domain-ownership evidence privately to Microsoft.

This appears to require Microsoft Data Protection / Tenant Recovery rather than ordinary Authenticator troubleshooting. Please advise how I can open or escalate a tenant-recovery case and securely verify ownership without signing in to the locked administrator account.

For security, I have not included the tenant name, email address, billing details, or DNS records in this public post.

0 comments

1 answer

Your answer

Answer 1

Hi @james Warren

To regain access, you will need to contact Microsoft Support and request escalation as a Tenant Lockout / Sole Global Administrator MFA Recovery case via phone service number: Contact Microsoft Support

When calling the support number, you may first hear a recorded message lasting approximately 30 seconds (for example, suggesting that you visit an online support page). You can simply wait for the menu options to be presented. Typically, selecting "1" for business users and then "1" again for technical support will guide you to the appropriate support flow.

In some regions, the initial interaction may be handled entirely by an automated system. To help you prepare, below is an example of the questions you may receive and the recommended responses:

What kind of problem are you experiencing?

Answer: Authenticator

What product are you using?

Answer: Office 365 for business

Is this for an education or company account?

Answer: For companies

Are you an administrator?

Answer: Yes

Are there any other administrators in your organization?

Answer: No. I am the only administrator in the tenant.

Do you need a Service Request?

Answer: Yes. I need to open a support ticket. Please transfer me to the Data Protection team.

Please note that this team is always overwhelmed, so you might need to wait for them to call you, this should take 3-10 working days.

In case the phone support line is unavailable or unable to assist, you could consider to create a separate Microsoft 365 trial tenant and use it solely for submitting a support request.

Here's how you can do it:

Go to Microsoft 365 Business Plans & Pricing | Microsoft 365 (select "Try for free" in an enterprise subscription).

Follow the instructions provided to create a trial tenant.

Once the new tenant is created, go to the Microsoft 365 Admin Center > Help and Support to submit a support ticket, requesting to speak with the Data Protection Team on behalf of your original tenant.

In the ticket description, you'll need to clearly explain that you're trying to regain access to your previous Microsoft 365 tenant as a single admin and that you need help from the Data Protection team.

Note:

This new trial tenant will not give you access to any data or settings from your original locked-down tenant. It only serves as a temporary means of contacting Microsoft support.

Remember to cancel the trial subscription of the new tenant once the issue with the original account is resolved, to avoid unwanted charges. Cancel your Microsoft business subscription in the Microsoft 365 admin center | Microsoft Learn.

I hope this information helps you successfully escalate your request and regain access to your tenant. If you have any updates or additional questions, please feel free to reply to this thread. I will be happy to continue assisting you.