Locked out of Admin Centre due to Authenticator failure

Paul@sp2k 20 Reputation points
2026-10-20T01:58:35.4+00:00

I am currently logged into my Microsoft 365 account, using office products, saving and uploading etc, but want to change an account setting in Admin Centre, but am prompted to log in using Authenticator. However Authenticator requires me to login using an Authenticator, so am stuck in an authenticator loop. The other sign-in options such as sms or call my phone give me an error as well (Error code 399287). All other attempts to sort this issue fail, as they all invariably lead me back to having to authenticate. The only thing I have been able to do is change my passowrd, but that doesn't allow me to complete actions where mfa is required. Calling Microsoft support has me talking to a bot, that directs me back to a website, where I also need to authenticate. So frustrating. Can anyone suggest any other solutions?

Microsoft 365 and Office | Subscription, account, billing | For business | Other
0 comments
Answer accepted by question author
Aetherin 3,680 Reputation points Independent Advisor
2026-10-20T02:54:32.8+00:00

Hi @Paul@sp2k,

If you are the only administrator in the tenant and have lost access because you're stuck in an MFA verification loop, then contacting Microsoft Support by phone is the correct and official process to regain access. In this situation, the Microsoft Data Protection team has tools and processes in place to verify your identity and help restore access to administrator accounts.

However, if you were not successful on your previous call, I would recommend trying again: Contact Microsoft customer support. The automated phone system can sometimes make it difficult to reach the appropriate team, so the following tips may help you navigate the IVR more effectively:

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)    

In some regions, the initial interaction may be automated, so here’s a general idea of how the conversation might go to help you prepare:      

  • What kind of problem are you experiencing?         
  • Answer: Authenticator         
  • What products do you use?         
  • Answer: Office 365 for business         
  • Is this for an education or company account?         
  • Answer: For companies         
  • Are you an administrator?         
  • Answer: Yes         
  • Are there any other administrators in your organization?         
  • Answer: No. I am the only admin in my tenant          
  • Do you need a... Service request?          
  • Answer: Yes. I need to create a ticket. Please send me direct to the Data Protection Teams.      

During the phone call, you will need to provide the information associated with your subscription, such as your company name, billing details, phone number, and an alternate email address, etc. This information allows the Data Protection team to verify your identity and securely assist you in regaining access to your administrator account.     

As this is a user-to-user support forum, I am not part of the Data Protection team and cannot directly verify accounts or bypass MFA requirements. However, I hope the guidance above helps you get past the automated system and reach a support agent who can move the case forward.

Please give it another try and let me know if you have any updates. Thank you for your understanding and patience.

Was this answer helpful?

1 person found this answer helpful.
0 comments

2 additional answers

Sort by: Newest
Most helpful Newest Oldest
  1. Paul@sp2k 20 Reputation points
    2026-10-20T19:20:46.2733333+00:00

    Thanks Aetherin,

    Yes that support bot was certainly frustrating, but your tips got me started to get a ticket open. Am now just waiting for a response. Thanks again

    Was this answer helpful?

  2. AI answer

    2026-10-20T19:18:22.1566667+00:00

    Error 399287 may be a temporary verification-method block, but if no registered MFA method works, the reliable recovery path is either an MFA reset by another authorized administrator or tenant recovery through Microsoft’s Data Protection team.

    Being signed in to Office applications does not provide an MFA-authenticated session for the Microsoft 365 admin center, which separately requires MFA; changing the password also does not reset authentication methods.^1^

    If another administrator can sign in

    Ask another Global Administrator or Privileged Authentication Administrator to reset your authentication methods. The Privileged Authentication Administrator role is required for MFA-reset actions involving administrator accounts.^2^

    That administrator should:

    1. Open Microsoft Entra admin center.
    2. Go to Entra ID → Users.
    3. Select your account, then Authentication methods.
    4. Select Require re-register MFA and confirm.
    5. If appropriate, select Revoke sessions as well.
    6. Sign in again and register Microsoft Authenticator as a new method.

    Require re-register MFA removes the account’s existing phone, Authenticator, software OATH, and hardware OATH registrations so that new methods can be enrolled.^3^

    If you are the only administrator

    Because the normal support site also requires authentication, call Microsoft’s business support number for your country and request a service case for Data Protection / Tenant Recovery.^4^

    Use this wording with the automated system or agent:

    Microsoft 365 for business. I am the sole Global Administrator and cannot complete MFA. Authenticator is unusable, SMS and voice fail with error 399287, and I need a Data Protection or Tenant Recovery case to remove the phone reputation block or reset my MFA methods.

    If prompted by the automated system:

    • Issue: Authenticator
    • Product: Office 365 for business
    • Account type: Company
    • Administrator: Yes
    • Other administrators available: No
    • Request: Create a service request and escalate it to the Data Protection team

    This recovery route has been used for the same sole-administrator, Authenticator failure, and error 399287 combination.^5^

    Have the following available for private verification—do not post it publicly:

    • Tenant domain and affected administrator sign-in name
    • Subscription and billing details
    • Company information
    • Alternate email address and telephone number
    • Error code, timestamp, request ID, and correlation ID from the failed sign-in
    • Evidence of domain ownership if requested

    If the phone system still will not create a case

    Use a separate, temporary Microsoft 365 trial tenant only to open the support request:

    1. Create a new Microsoft 365 business trial and its separate administrator account.
    2. Sign in to that tenant’s Microsoft 365 admin center.
    3. Open Support → Help & support.
    4. If Contact Support does not appear, turn Support Assistant off and enter the issue again.
    5. State clearly that the case concerns a different, existing tenant whose sole Global Administrator is locked out.
    6. Request escalation to Data Protection / Tenant Recovery.
    7. Cancel the trial after recovery to prevent charges.

    The temporary tenant does not provide access to the locked tenant; it only provides an authenticated route for creating the support case.^6^

    If the subscription was purchased through a Microsoft partner or reseller, ask that provider to open the service request on your behalf instead.^6^

    Temporary-block possibility

    Stop making repeated SMS, call, and sign-in attempts. Microsoft documents that repeated attempts or unusual activity can trigger a temporary verification block; waiting a day may clear it, although some blocks can take longer. If it clears, use the working method once and immediately register an additional MFA method.^7^

    After access is restored, maintain at least two Global Administrator accounts with distinct credentials and MFA methods to prevent another tenant-wide lockout.^2^

    References

    1. Mandatory multifactor authentication for Azure and admin portals
    2. Preventing tenant lockouts
    3. Manage user authentication methods for Microsoft Entra multifactor authentication
    4. Contact Microsoft customer support
    5. Admin account locked by MFA - Microsoft Q&A
    6. Sole global administrator locked out – SMS MFA blocked (error 399287) - Microsoft Q&A
    7. Common problems with two-step verification for a work or school account
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.