Sole Global Administrator Locked Out of Azure Tenant After iPhone Replacement — MFA Recovery Assistance Needed

Question

Sole Global Administrator Locked Out of Azure Tenant After iPhone Replacement — MFA Recovery Assistance Needed

randolph stephenson 0

Hello Microsoft Support Team,

I am the sole Global Administrator of my personal Azure Pay-As-You-Go tenant and am unable to access the Azure portal after replacing and wiping my previous iPhone.

My Microsoft account authenticates successfully using my passkey and Microsoft Authenticator, but a subsequent MFA challenge requests approval through Authenticator that never arrives on my new device.

Troubleshooting completed:

Verified my Azure CLI session is still authenticated.

Confirmed my account holds the Global Administrator role.

Confirmed I am the only Global Administrator listed in the tenant.

Attempted to create an Azure support ticket through the REST API, but the operation failed with InvalidSupportPlan.

Attempted Microsoft's telephone and online support channels but was repeatedly redirected to the MFA-blocked sign-in process.

I am requesting assistance with sole Global Administrator MFA recovery and escalation to the appropriate Microsoft Data Protection or tenant recovery team.

I can provide my tenant ID, subscription ID, account details, and proof of ownership through a private message.

Please advise how I can initiate the recovery process without access to the Azure portal.

Thank you.

0 comments

2 answers

Your answer

Answer 1

Hin Vo 1,745 Independent Advisor

Hi @randolph stephenson

Since you mentioned that your Azure CLI session is still authenticated, may I know whether you are still able to perform administrative actions through Azure CLI or Microsoft Graph, such as creating a new user account, assigning the Global Administrator role to another account, or successfully managing Microsoft Entra ID objects?

If the phone support channel is unavailable or unable to assist, you may consider creating a separate Microsoft 365 trial tenant solely for the purpose of submitting a support request.

Here's how you can do it:

Go to Microsoft 365 Business Plans & Pricing | Microsoft 365 (select "Try for free" in an enterprise subscription).

Follow the instructions provided to create a trial tenant.

Once the new tenant is created, go to the Microsoft 365 Admin Center > Help and Support to submit a support ticket, requesting to speak with the Data Protection Team on behalf of your original tenant.

In the support ticket, clearly explain that you are locked out of your original tenant as the sole Global Administrator due to an MFA issue and would like the case reviewed for escalation to the Data Protection Team (DPT) or the appropriate tenant recovery team.

Note:

This new trial tenant will not give you access to any data or settings from your original locked-down tenant. It only serves as a temporary means of contacting Microsoft support.

Remember to cancel the trial subscription of the new tenant once the issue with the original account is resolved, to avoid unwanted charges. Cancel your Microsoft business subscription in the Microsoft 365 admin center | Microsoft Learn.

I hope this information helps you successfully escalate your request and regain access to your tenant. If you have any updates or additional questions, please feel free to reply to this thread. I will be happy to continue assisting you.

randolph stephenson 0 Reputation points

2026-11-04T23:55:40.41+00:00

Thank you for your guidance.

I created a separate Microsoft 365 trial tenant as suggested and successfully accessed the Microsoft 365 Admin Center.

However, the new billing account is currently Under Review, and Help & Support only provides a telephone number. There is no option to create a service request or contact an engineer directly.

The telephone support system previously redirected me to the same authentication-blocked support websites.

Is there a way for a Microsoft moderator or support representative to initiate a private tenant recovery escalation for my original Azure tenant?

I can provide proof of tenant ownership, subscription information, and billing details through a secure private channel.

Thank you.
Hin Vo 1,745 Reputation points Independent Advisor

2026-11-05T05:08:39.5066667+00:00

Hi @randolph stephenson

If you have not yet been able to submit a support request, please make sure that the Support Assistant (AI) is turned off in the Help pane before proceeding. Several customers have reported that when the Support Assistant is enabled, the Contact Support option may not appear as expected.

To proceed:

Open Help & Support.

Turn Support Assistant to Off.

Enter your issue description.

Type "I need agent support via phone or email".

Select Contact Support once the option becomes available.

Choose your preferred contact method.

Complete the support request form and provide as much detail as possible regarding the affected tenant, including that all Global Administrators are locked out due to MFA and no alternative authentication methods are available.

Finally, click Contact me to submit the request.

After the request has been submitted, you should receive updates from the assigned support team regarding the next steps and any tenant recovery validation requirements.
randolph stephenson 0 Reputation points

2026-11-05T13:15:33.97+00:00

Hi Hin,

Thank you for the additional instructions.

I followed your steps exactly, including disabling Support Assistant and entering "I need agent support via phone or email."

Unfortunately, Contact Support still only displays a telephone number. No email, callback, or service-request form is available.

My newly created Microsoft 365 billing account is currently marked "Under Review."

Could this review status be preventing me from creating a support request? Is there another way to request a private Data Protection / Tenant Recovery escalation for my original Azure tenant?

Thank you for your continued assistance.

Answer 2

This is a tenant-lockout case: call Microsoft business support without signing in, require a case to be opened against the existing Azure tenant, and request escalation to the Data Protection/Tenant Recovery team for ownership verification and administrator-access recovery.^1^

Initiate recovery without portal access

Open Microsoft’s regional support directory and select a technical-support number for your country or region: ^2^
In the automated flow, identify this as:
- A business/work account issue.
- Microsoft Azure / Microsoft Entra ID.
- Technical support.
- An administrator sign-in or Authenticator problem.
- No, when asked whether another administrator can help.
When connected to an agent, use precise wording:

This is a Microsoft Entra tenant lockout. I am the sole Global Administrator, the registered Authenticator device was wiped, no other administrator can reset my authentication methods, and I cannot access any administrative portal. Please open a support case against the original locked tenant and escalate it to the Data Protection/Tenant Recovery team for high-assurance ownership verification and administrator-access recovery.

Microsoft’s recovery documentation states that when portals are inaccessible, the customer can call support; Microsoft then verifies tenant ownership and helps designated Global Administrators regain access to the existing tenant.^1^
If the agent redirects you to an authenticated portal, repeat that:
- Portal authentication is the subject of the incident.
- There is no second Global Administrator.
- The request must be created manually against the original tenant.
- You need a case number before ending the call.
Microsoft’s Partner Center guidance also identifies the Azure Data Protection team as the team that handles the “only global admin” scenario.^3^
If the first agent cannot create or route the case, call the other technical-support number listed for your region and request a supervisor or business-support agent. Since the telephone and online loops have already failed, do not accept another instruction that requires signing into the locked tenant.

Prepare for ownership verification

Have these available, but provide them only through the private support case or direct communication from the assigned Microsoft agent:

Tenant ID and primary tenant domain.
Locked Global Administrator sign-in name.
Azure subscription ID and Pay-As-You-Go billing details.
Recent invoice/order information and payment evidence.
Account and subscription contact details.
Access to the registered contact email and telephone.
Domain/DNS ownership evidence, if the tenant uses a verified custom domain.
A reachable alternate email address that does not depend on the locked tenant.

Do not post tenant IDs, subscription IDs, invoices, payment details, or account identifiers in this public thread.

About the failed REST support request

A current Azure CLI token does not itself repair the unavailable MFA registration. Azure’s support API can create several ticket types, but technical support requires an eligible support plan; Azure provides unlimited support only for subscription-management matters such as billing, quota adjustments, and account transfers.^4^

Because your REST request already returned InvalidSupportPlan, do not repeat that route for this recovery incident. Ask the telephone agent to record that error in the manually opened tenant-lockout case.

One last non-escalation check

Only if the sign-in page displays Sign in another way or Other verification options, select a previously registered phone, security key, or other independent method. If no alternative is shown, Microsoft’s MFA guidance says administrator assistance is required; in a sole-administrator lockout, that means Microsoft Support rather than another tenant administrator.^5^

After access is restored

Remove the obsolete Authenticator registration and register the new device.
Create at least two cloud-only emergency access accounts in the *.onmicrosoft.com domain.
Assign each a permanent active Global Administrator role.
Use phishing-resistant authentication independent of the personal phone, such as FIDO2 security keys.
Exclude emergency accounts from Conditional Access policies that could block sign-in.
Securely store their credentials, monitor every use, and validate them at least every 90 days.^6^

References