Azure Tenant Lockout: Sole Global Administrator Cannot Sign In Due to Deleted Email Account

Submit an unauthenticated Azure support request and explicitly request Microsoft Entra tenant recovery/Data Protection escalation, because no administrator remains who can reset the account from inside the tenant.

Open the recovery case without Azure Portal access

1. Open Microsoft’s Azure support request page for users who cannot sign in:
   ^1^
2. Select the available Get Help, Contact Support, or support-request option.
3. Use a working email address and telephone number that Microsoft can use to contact you. Microsoft’s administrator-password guidance specifically directs a sole Azure administrator who forgot the password to Azure Support and asks that the request include contact details.^2^
4. Describe the case in precise terms:

   Complete Microsoft Entra tenant lockout. The only Global Administrator cannot sign in, the original email account no longer exists, no alternative administrator is available, and the Azure subscription remains active. Please escalate this case to the Data Protection/Tenant Recovery team for organizational ownership validation and restoration of administrative access.

5. Include, without posting sensitive values publicly:
   • Tenant’s initial *.onmicrosoft.com domain, if known
   • Verified custom domain
   • Azure subscription ID and billing-account details, if available
   • Company legal name and address
   • Recent invoice numbers or payment information
   • Working contact email and telephone number
   • A statement that the former recovery mailbox was deleted

Microsoft Support will determine the exact ownership-verification evidence required; the available documentation does not publish a universal domain-verification checklist. Closely matched sole-Global-Administrator lockout cases are handled through a support ticket and Data Protection follow-up by email or phone.^3^

Do not publish the tenant ID, subscription ID, invoices, payment details, email addresses, or telephone numbers in this public Q&A thread.

If the unauthenticated request does not create a case

Use the public Microsoft customer-support page, choose the business/work-account route, and request Azure/Microsoft Entra tenant lockout escalation.^4^

If that still does not produce a ticket, a closely matching accepted Q&A resolution recommends creating a temporary trial tenant and submitting a support request from that tenant on behalf of the locked tenant. State clearly that the new tenant is only the support-contact vehicle and provide the locked tenant’s identifying information privately to Support. Cancel the trial afterward to avoid charges.^5^

A Q&A moderator may be able to engage the recovery team in an individual thread, as occurred in similar cases, but moderators do not have direct access to tenant administration and cannot guarantee or expedite recovery. The support case remains the operative recovery channel.^5^

After access is restored

Create at least two cloud-only emergency-access accounts using the tenant’s *.onmicrosoft.com domain, assign permanent active Global Administrator access, protect them with independent phishing-resistant authentication, store credentials securely, exclude them from Conditional Access policies that could block sign-in, and test them regularly. Microsoft recommends two or more such accounts specifically to prevent administrative lockout.^6^

References

1. Troubleshoot Azure subscription sign-in issues
2. Forgot password to sign in to Microsoft 365, Intune, or Azure
3. Sole Global Admin locked out of Entra ID tenant — Authenticator MFA loop / tenant lockout - Microsoft Q&A
4. Contact Microsoft customer support | Microsoft Support
5. Sole Global Administrator Locked Out of Tenant - Need Tenant Recovery - Microsoft Q&A
6. Manage emergency access accounts in Microsoft Entra ID