Locked out of our only Microsoft 365 Global Admin account – MFA recovery needed

Denise Janssens 0 Reputation points
2026-10-26T11:24:36.8766667+00:00

Hello,

We are currently locked out of our company's only Microsoft 365 Global Administrator account.

This morning, I was able to log in using just the email address and password. Later, I activated my own Microsoft 365 license using my personal work account and configured Microsoft Authenticator for that account.

When I tried to log back into our main administrator account, Microsoft suddenly required an Authenticator code. However, we have no access to an Authenticator linked to this account, and there is no option to use another verification method.

Unfortunately, this is our only Global Administrator account, so we cannot reset MFA ourselves.

I have already contacted Microsoft Support by phone, but the automated system keeps redirecting me to self-service websites, which require me to log in.

Could a Microsoft moderator please help us escalate this to the Data Protection / Tenant Recovery team?

We can provide proof of ownership of our Microsoft 365 tenant if necessary.

Thank you in advance for your help!

Microsoft 365 and Office | Subscription, account, billing | For business | MacOS
0 comments

2 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-10-26T11:25:29.3333333+00:00

    Because the only Global Administrator has no usable MFA method and telephone self-service has already failed, create a temporary Microsoft 365 trial tenant and use its admin center to open a support request for the Data Protection/Tenant Recovery team on behalf of the locked tenant.^1^

    Open the recovery case

    1. Sign up for a Microsoft 365 Business trial using a new account, creating a separate temporary tenant.
    2. Sign in to that tenant’s Microsoft 365 admin center.
    3. Select Help & support in the lower-right corner.
    4. Enter the issue, then select Contact Support and choose phone or email.^2^
    5. Submit wording similar to:

      Our organization is locked out of its original Microsoft 365 tenant. The affected account is its only Global Administrator, the password is accepted, but the account requires Microsoft Authenticator and has no accessible or alternative MFA method. This temporary tenant was created solely to open a case. Please escalate the request to the Data Protection/Tenant Recovery team for identity verification and recovery of the original tenant.

    6. Make clear that the case concerns the original tenant, not the temporary one. The temporary tenant does not grant access to the original tenant; it only provides an authenticated channel for opening the support request.^3^
    7. Cancel the trial after recovery to avoid unintended charges.^1^

    A Q&A moderator cannot reset MFA, bypass identity verification, or recover the tenant directly. Do not post tenant identifiers, invoices, contact details, or other ownership evidence publicly.

    Prepare ownership verification

    Have the following ready for the assigned support engineer:

    • Original *.onmicrosoft.com tenant name
    • Affected Global Administrator sign-in name
    • Company name and custom domain
    • Ability to prove domain ownership, potentially through DNS
    • Subscription and billing details
    • Recent invoices or purchase records
    • Registered business contact details
    • A reachable alternate email address and telephone number
    • Business registration or other organizational documentation

    Microsoft support uses identity and organizational-ownership verification before restoring administrative control.^4^

    Conditional alternatives

    • If a Microsoft Cloud Solution Provider or IT partner sold or manages the subscription: contact that partner first. Microsoft’s business-support documentation directs customers whose subscriptions were purchased entirely through a partner to obtain support from that partner.^2^ A partner with an active, appropriately privileged GDAP relationship may be able to assist or create the service request; otherwise Microsoft Support must handle the lockout.^5^
    • If using the public support page instead: select Get Help, describe “Microsoft 365 business sole Global Administrator locked out by MFA,” and then select Contact Support if offered.^6^ Since the telephone path has already redirected you to inaccessible self-service pages, the temporary-tenant ticket is the more concrete next step.

    After access is restored

    1. Register at least two independent MFA methods for administrative accounts.
    2. Create administrative redundancy with distinct credentials and MFA methods.
    3. Assign at least one trusted account the Privileged Authentication Administrator role so it can assist if a Global Administrator is locked out. Microsoft specifically recommends this safeguard.^7^
    4. Document the emergency recovery process and securely retain subscription, tenant, and support details.

    References

    1. Sole Global Administrator locked out due to MFA / Microsoft Authenticator – Tenant Recovery required - Microsoft Q&A
    2. Get support for Microsoft 365 for business
    3. MFA device lost, only Global Admin, tenant lockout - Microsoft Q&A
    4. Tenant access recovery
    5. Preventing tenant lockouts
    6. Contact Microsoft customer support | Microsoft Support
    7. About administrator roles in the Microsoft 365 admin center
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. Roebe Ta 1,825 Reputation points Independent Advisor
    2026-10-26T11:44:57.3366667+00:00

    Hello @Denise Janssens ,

    I'm sorry to hear that your only Global Administrator account is locked out.

    First of all, I would like to clarify one point: this forum is intended for users to assist one another. No one, including myself, has the authority or the tools to recover admin access on your behalf.

    I also cannot escalate your case to the Data Protection / Tenant Recovery team on your behalf. To protect your organization's security and privacy, Microsoft requires the tenant owner or an authorized representative to initiate the recovery process directly and provide the necessary verification information.

    To help, I'd like to share the prompt that has successfully helped many other users reach the Data Protection Team and create a support request:

    1. Find the related hotline number for your country to call the frontline and let them raise a ticket for you: Customer service phone numbers - Microsoft Support 

    2. Depending on your country or region:

    For some countries, when calling the support number, although there are about 30 seconds opening as something "you can visit the link...." But you can ignore this opening and wait until the option, then "1" as a business email user, "1" again for technical help.   

    For some countries, it will be an automated conversation like:    

    • First, when you call the hotline, it asks what kind of problem you are worried about.   
    • Answered: authenticator.   
    • A: What kind of product are you using?   
    • B: Microsoft 365 for business.   
    • A confirmation: education or company account?   
    • B: For companies   
    • A: Are you an administrator?   
    • B: Yes.   
    • A: Do you have the other admin in your organization?   
    • B: No.   
    • A: You need one.... Service request?   
    • B: Yes   

    Important note:

    • You may need to call multiple times before you are connected to a live support representative and can successfully create a support request with a ticket number for tracking. 
    • If calling the support line in your region is difficult, you may try another regional support number that offers service in your language, or contact the English support line if you’re comfortable speaking English. 
    • If your subscription is from a partner or reseller, contact the reseller's support provider to help open a service request on behalf of you instead.   

    If you still have trouble using the phone support, you can try set up a new trial tenant and submit your support request:  Compare Office 365 Enterprise Pricing and Plans | Microsoft 365.

    User's image

    Once the new tenant is created, navigate to Microsoft 365 Admin center and create a support request: Get support - Microsoft 365 admin | Microsoft Learn . 

    User's image

    User's image

    During the process, you must clearly state that you are locked out of a different, pre-existing Microsoft 365 tenant where you are the administrator. Provide the following information about your locked account:   

    • The domain name of your locked tenant     
    • Your administrator account. 
    • Any error messages you are receiving.    
    • Details about the authentication issues you are experiencing.    
    • Your proof of ownership. 

    Important notes:

    • This new trial tenant will not give you access to any of the data or settings in your original locked tenant. It is solely a temporary means to contact Microsoft support.  
    • Be prepared for Microsoft support to ask for verification of your identity and administrative rights for the locked tenant. 
    • The resolution time might be longer as you are contacting support from a different tenant.    
    • Remember to cancel the trial subscription for the new tenant once your issue with the original account is resolved to avoid any unintended charges. You can typically do this within the Microsoft 365 Admin Center under "Billing" -> "Your products." 

    I hope this helps. If you need any further assistance, please feel free to leave a comment.

    Kind Regards.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.