Sole Global Admin locked out of MFA (error 500121) – need Data Protection ticket for Partner Center account

Question

Sole Global Admin locked out of MFA (error 500121) – need Data Protection ticket for Partner Center account

Chadd Phillips 0

I’m the only Global Administrator for my company’s Microsoft Entra tenant, which is linked to our Microsoft Partner Center account. I can no longer complete Microsoft Authenticator verification, and every sign-in attempt fails with error code 500121.

I have no other registered MFA method and no second Global Administrator, so I can’t re-register MFA or reach Security info to get a new Authenticator QR code.
Self-service options and the “Use a verification code” option don’t work.
Error code: 500121
Correlation ID: 357ba166-5c93-4d28-aabc-b2ee76a7c058
Timestamp: 2026-11-05 23:23:32 UTC

Could a moderator please help me open a ticket with the Data Protection team to verify my identity and domain ownership and reset my MFA? I can verify domain ownership through DNS and can provide my contact details privately.

Thank you.

0 comments

1 answer

Your answer

Answer 1

Hello Chadd,

Q&A moderators can't open Data Protection tickets on your behalf. Because your tenant is linked to Partner Center, though, there's a documented route that doesn't require signing in.

1. Open a Partner Center ticket without signing in

Partner Center's sign-in troubleshooting page provides a support form for partners who can't sign in: https://partner.microsoft.com/support?stage=2&topicid=6b52f3cf-3b36-df07-f75b-27aa68bf8a01

In the description, say you're the sole Global Administrator, you've lost MFA (error 500121), and you can prove domain ownership via DNS. Include the correlation ID and timestamp you posted. Support routes it to the team that does admin ownership verification.

For the sole-admin case, the same page also lists the Azure Data Protection team: +1 866-807-5850.

2. Quick checks on 500121 before you wait

500121 means the MFA step was started but not completed. If you still have the phone with Microsoft Authenticator on it:

"Use a verification code" fails: the 6-digit codes are time-based. Set the phone's date/time to automatic and retry. A clock that's off by a minute or two is enough to reject every code.
Approvals never arrive: open the Authenticator app manually while signing in. Pending requests often appear there when the push notification doesn't. Also check that notifications aren't disabled or battery-optimized for the app.
New or restored phone: a work account restored from Authenticator backup can't approve sign-ins until it's re-registered. That's the case where you need the ticket above.

3. After recovery

Add a second MFA method and create a separate cloud-only break-glass Global Administrator with a FIDO2 key. Partner Center specifically recommends this for exactly this situation.

References: Troubleshoot Partner Center sign-in issues · Manage emergency access accounts