how to unblock Global Administrator

Contact Microsoft business support by phone and request escalation to the Microsoft 365 Data Protection team for sole Global Administrator tenant recovery; recovery requires Microsoft to verify tenant ownership before restoring administrative access.^1^

Start the recovery request

1. Open Microsoft’s regional support-number page and select the number for your country or region.^2^
2. Tell the representative:
   • This is a Microsoft 365 business tenant lockout.
   • The affected account is the sole Global Administrator.
   • The account is blocked and password recovery cannot be completed.
   • No other Global Administrator or Privileged Authentication Administrator is available.
   • You need transfer or escalation to the Microsoft 365 Data Protection team.
3. Request a case number and provide a working external email address and phone number for follow-up.
4. Submit confidential account, billing, and identity information only through the official support case—not in this public forum.

Microsoft’s tenant-lockout guidance confirms that when a Global Administrator has lost access and no other Global Administrator exists, the administrator must contact Microsoft Support.^3^

Prepare ownership-verification information

Have the following available:

• Tenant name and, if known, Tenant ID
• Affected administrator username
• Organization’s legal name, address, and contact information
• Microsoft 365 subscription details
• Previous invoices, order numbers, and billing/payment information
• Custom-domain ownership evidence, if the tenant has a custom domain
• Original subscription or tenant-registration information
• A reachable company contact
• Any information Microsoft requests through the case

The exact questions and recovery actions are determined by the Data Protection team. Similar sole-administrator recovery cases identify tenant, organization, domain, and billing records as useful verification material.^4^

If phone support cannot open the case

A documented workaround from a closely matching tenant-lockout case is:

1. Create a temporary Microsoft 365 trial tenant.
2. Sign in to its Microsoft 365 admin center using the temporary Global Administrator.
3. Select Help & support.
4. If Support Assistant appears, turn it off.
5. Search for contact support, select Contact support, and request phone or email assistance.
6. Clearly state that the case concerns a different, locked tenant and request Data Protection/tenant-recovery escalation.
7. Cancel the trial after the support case is established to avoid renewal charges.^5^

If a Microsoft partner already has active GDAP permissions with an appropriate role, ask that partner to restore access or open the service request. A partner needs an active GDAP relationship with the Service Support Administrator role to create a support request; Data Protection will still work directly with the customer for verification.^3^

If the displayed message says the block is temporary

If the exact message says the account is temporarily locked, stop repeated sign-in or verification attempts because they can reset the lock timer. Microsoft recommends trying an already-registered alternative verification method or another network, then waiting at least 24 hours; some blocks can last longer, up to one week.^6^

Do not delay opening the recovery case if no usable verification method exists or the account remains inaccessible.

After access is restored

Create at least two cloud-only emergency-access accounts on the tenant’s .onmicrosoft.com domain, assign permanent active Global Administrator roles, use authentication methods independent of normal administrator accounts, securely store their credentials, monitor their use, and test them regularly. Microsoft recommends two or more such “break-glass” accounts to prevent another complete lockout.^7^

References

1. Troubleshoot sign-in issues and account access problems
2. Contact Microsoft customer support
3. Preventing tenant lockouts
4. Sole Global Administrator locked out due to unavailable MFA – no other admin in Microsoft 365 tenant - Microsoft Q&A
5. Sole Global Administrator locked out due to Microsoft Authenticator MFA loop – Tenant Recovery needed - Microsoft Q&A
6. Common problems with two-step verification for a work or school account
7. Manage emergency access accounts in Microsoft Entra ID