Locked Out of Microsoft 365 – Sole Global Administrator Unable to Complete MFA

Abdulrhman Zaher 0 Reputation points
2026-11-05T11:10:59.76+00:00

Hello Microsoft Support Team,

I am the sole Global Administrator of our organization's Microsoft 365 tenant.

I am currently unable to access my administrator account because Microsoft Authenticator is registered on my old Samsung device, which has a damaged screen and is no longer accessible.

I have attempted to set up Microsoft Authenticator on my new iPhone, but I cannot complete the registration because the existing authentication method requires approval from the old device.

Unfortunately, there is no other Global Administrator in our organization who can reset my MFA settings or create an alternative authentication method.

I can provide the necessary proof of identity, domain ownership, and tenant ownership through your official verification process.

I kindly request assistance with:

  1. Recovering access to my Global Administrator account.
  2. Resetting or re-registering my MFA authentication methods.
  3. Restoring administrative access to our Microsoft 365 tenant.

This issue is preventing me from managing our organization's Microsoft 365 services.

Please escalate this case to the appropriate Data Protection or Tenant Recovery team.

Thank you for your assistance.

Microsoft 365 and Office | Subscription, account, billing | For business | Other
0 comments

2 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-11-05T11:12:25.5233333+00:00

    On the MFA prompt, select Sign in another way; if it offers no accessible method, contact Microsoft 365 business support and request a service request for sole Global Administrator MFA lockout and Data Protection/Tenant Recovery.

    1. Check for an existing alternative method

    1. Start the administrator sign-in normally.
    2. At the Authenticator approval prompt, select Sign in another way.
    3. If a previously registered phone, security key, passkey, or other usable method appears, complete verification with it.
    4. If the link is absent or every listed method is inaccessible, proceed to tenant recovery. The absence of Sign in another way generally means no alternative verification method was configured.^1^

    Installing Authenticator on the new iPhone does not transfer the old device registration by itself, so repeating that setup will not resolve this lockout.

    2. Open a tenant-recovery case

    This Q&A forum cannot directly reset the account or escalate a private support case. Closely matching sole-administrator lockouts have required a Microsoft support ticket handled through the Data Protection team.^2^

    Call the current Microsoft 365 business support number for your country or region. Microsoft publishes the regional-number route and provides technical support in English 24 hours a day, seven days a week.^3^

    Use this description with the automated system or representative:

    Microsoft 365 for business. I am the sole Global Administrator. The registered Microsoft Authenticator device is unavailable, no other administrator can reset my methods, and I need a service request for tenant ownership verification and Data Protection/Tenant Recovery.

    If prompted by the automated system, select or state:

    • Product: Office 365 or Microsoft 365 for business
    • Issue: Authenticator / administrator sign-in
    • Administrator: Yes
    • Another administrator available: No
    • Need a service request: Yes

    A matching sole-admin recovery case recommends this routing to reach an agent who can create the recovery request.^4^

    3. Prepare ownership evidence

    Have the following ready, but provide it only through the private Microsoft support case, not in this public thread:

    • Tenant ID and tenant name
    • Affected Global Administrator username
    • Custom domain and evidence that the organization controls its DNS
    • Organization name and business-registration information
    • Microsoft subscription details, order information, and previous invoices
    • Billing contact and payment information
    • A reachable alternate email address and telephone number
    • Details of the registered organization contact

    Phone support uses a PIN-based verification process. If calling from a number not registered in the organization profile, the representative may send a verification code to the registered email address or phone number.^3^ If neither is accessible, tell the representative immediately and ask which alternative tenant-ownership verification evidence the recovery team requires; do not publish that evidence here.

    If all subscriptions were purchased through a Microsoft partner rather than directly from Microsoft, contact that partner first; Microsoft’s online business-support entitlement requires at least one subscription purchased directly from Microsoft.^3^

    4. If phone support cannot create the case

    A case-matched workaround is to create a separate Microsoft 365 Business trial tenant, sign in as its administrator, and open a support request concerning the locked primary tenant.^5^

    In the temporary tenant:

    1. Open Microsoft 365 admin center.
    2. Select Help & support.
    3. Enter contact support.
    4. If Support Assistant does not resolve it, select Contact Support.
    5. Choose phone or email and describe the locked tenant, making clear that the ticket concerns a different tenant.
    6. Cancel the trial afterward to avoid renewal charges.

    After access is restored

    Microsoft Support may reset the affected authentication methods as part of recovery. If further cleanup is required, have another appropriately privileged administrator open:

    Microsoft Entra admin center → Entra ID → Users → affected administrator → Authentication methods → Require re-register MFA

    That action deletes registered phone numbers, Authenticator registrations, and software OATH methods, then requires fresh MFA registration at the next sign-in.^6^ Do not assume the recovered administrator can perform this operation on their own account; the exact administrative role needed depends on the target account’s privilege level.

    After recovery:

    • Create at least one additional emergency administrative account.
    • Register at least two strong authentication methods for each administrator.
    • Prefer phishing-resistant methods such as passkeys or FIDO2 security keys.^7^

    References

    1. Use a screen reader to set up and troubleshoot multifactor authentication | Microsoft Support
    2. Microsoft365 Global Admin locked out, lost MFA (Authenticator) – need tenant recovery - Microsoft Q&A
    3. Get support for Microsoft 365 for business
    4. Sole Global Administrator Locked Out – Lost Microsoft Authenticator Access After New Phone - Microsoft Q&A
    5. Sole Global Administrator locked out due to Microsoft Authenticator MFA loop – Tenant Recovery needed - Microsoft Q&A
    6. Manage user authentication methods for Microsoft Entra multifactor authentication
    7. Recover user authentication methods using Microsoft Entra Backup and Recovery
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. Daniel-Vo 7,900 Reputation points Microsoft External Staff Moderator
    2026-11-05T11:43:37.02+00:00

    Dear @Abdulrhman Zaher ,

    Good day! Welcome to Microsoft Q&A forum!

    First of all, I would like to clarify one point: as a forum moderator, I do not have the authority or the tools to assist you in resolving issues related to your tenant, account details, billing information, or authentication settings on your behalf.

    Furthermore, current forum moderators do not have the authority to create tickets on your behalf. Tickets can only be created via calling or the Admin Center portal.

    Based on your description, I understand that you're the sole administrator of your Microsoft 365 Business tenant and are locked out of your account because your MFA was tied to an old phone. You're looking for assistance with admin account recovery and guidance on reaching Microsoft's Data Protection Team.

    If you're the only admin, in this situation, the Microsoft Data Protection Team has tools and processes in place to verify identity and regain access to administrator accounts. Please try to find the related hotline number to call the frontline let them raise a ticket for you: Technical or Sales support phone numbers (for Work account, scroll down to find your region's number) 

    In some countries, this is an automated conversation: First, when you call the hotline, they will ask you what kind of problem you are struggling with. 

    Answer: Authenticator.

    A: What products do you use?

    B: Office 365 for business. 

    Verification: Education or company account? 

    B: For companies 

    A: Are you an administrator? 

    B: Yes. 

    A: Are there any other administrators in your organization? 

    B: No. 

    A: I need one.... Service request? 

    B: Yes 

    (Important Note: Sometimes, you would hear the computer-generated voice at first, please kindly wait for it to end, and if an agent is available, you would be directed to them and get your support. Depending on your country or region, when you call the support number, you may hear an introduction of about 30 seconds such as "You can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.) 

    As an alternative, you can create a new tenant account and submit your request from there.    

    To set up a new tenant, please follow these steps: 

    Once your tenant is created, you should be able to access the support portal and submit your ticket referencing your locked account without further issues.

    In the ticket's description, you could refer to this message

    "Hello,

    I am currently locked out of my Microsoft 365 tenant because multi-factor authentication is enforced, and I am unable to complete the verification process. I am the only global administrator for this tenant, which means I cannot access my account or the Microsoft 365 Admin Center.

    To resolve this, I have created a new tenant and would like to be connected with the Data Protection Team to verify my identity and assist with regaining access. I am available to provide any required documentation or verification to support the recovery process."

    Ticket Support: Log in the Microsoft 365 Admin Center using the newly created trial admin account (not the currently locked one) > Support > Help & Support. You can raise support ticket at: https://admin.microsoft.com/#/support/requests   

    When you open a support ticket, please make sure to turn off the Support Assistant (AI) in the help panel.  

    Several customers have reported issues when the Support Assistant is turned on  the system sometimes fails to display the “Contact Support” option.  

    As shown in the screenshot, simply switch Support Assistant > Off, then type your issue description.  Once the AI is off, the “Contact Support” button will appear normally, allowing you to submit a ticket directly.

    User's image

    • After clicking on "Help & Support" button, you can type "I need agent support via phone or email". After that, you can click on "Contact support" 
    • Choose contact method: "Phone" 
    • Fill all the information in this contact support details, please describe your situation carefully so they will have enough information to help you. 
    • Finally, click on "Contact me"
    • After completing them, you will receive an email appointment for a meeting to review this issue professionally together. 
    • For more details, you could refer to this article: Get support for Microsoft 365 for business 

    Please remember to cancel the trial subscription once your issue is resolved to avoid any unintended charges.

    Kindly let me know when there are updates or if you need further assistance. Any updates you’re able to share would be really helpful.

    I'm here and happy to help! Thank you for your kindness and patience! 

    If you have additional questions regarding this response, kindly click Comment.

    Note: Please follow the steps in forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.