URGENT: Suspected Microsoft 365 tenant takeover; Global Administrator access lost

Question

URGENT: Suspected Microsoft 365 tenant takeover; Global Administrator access lost

Levent Sengecal 0

Hello Microsoft Q&A moderators,

Our company in Türkiye needs urgent assistance with a suspected Microsoft 365 tenant compromise and administrator lockout.

Our established administrator can still authenticate using Microsoft Authenticator, but all directory administrator roles are now missing.
We can no longer use the Microsoft 365 admin center or read Entra audit logs: access is denied.
A Global Administrator account that we do not recognize and did not create appears to be the only Global Administrator. Its password recovery phone is not ours.
Our original account's sign-in history shows several unexplained successful sign-ins from other countries, including Microsoft Azure CLI.
Our business email service is also experiencing problems.

We cannot create a support request through the normal Microsoft 365 admin portal because we have lost administrator permissions. Telephone support has not offered an accessible Turkish-language path.

Could an official Microsoft moderator please help us reach the Data Protection / Tenant Recovery team, open an urgent security/tenant ownership recovery case, and contact us privately? We can provide proof of company ownership, invoices, tenant identification and domain control through a VERIFIED, PRIVATE support channel.

Please do not request passwords, recovery codes, private tenant identifiers or sensitive screenshots in this public thread. We need written communication, preferably in Turkish.

Thank you.

0 comments

1 answer

Your answer

Answer 1

Hi Levent Sengecal

In case the phone line is not supportive, you can consider directly submitting a support request via trial tenant as a helpful workaround:

-Create a temporary Microsoft 365 tenant using a trial license: Go to Microsoft 365 Business Plans and Pricing and click Try for free to set up a temporary Microsoft 365 tenant with a trial license.

-Use this new account to sign in to the Microsoft 365 Admin Center and submit a support request on behalf of your primary (locked) account.

-Select the Help & support (headset) icon. If Support Assistant is enabled, turn it off > Type contact support in the search box > Select Contact support, then choose Phone or Email to submit your request.

Note: This method doesn't require you to use your new account for your business. Instead, it allows you to create a temporary global administrator account so you can submit a support request, as your original global administrator account is locked out due to issues with multi-factor authentication. The trial account is free for one month. Be sure to delete it after submitting your support request to avoid any automatic renewals or charges from Microsoft.

For further instructions, you can follow this guide: Get support - Microsoft 365 admin | Microsoft Learn.

I hope this information helps.

Levent Sengecal 0 Reputation points

2026-11-13T21:39:40.6933333+00:00

Thank you. Important clarification: this is NOT an MFA lockout. We can sign in and complete Microsoft Authenticator, but our legitimate administrator's Global Administrator role was removed without authorization. An unfamiliar account is now the only visible Global Administrator. We also see unexplained successful foreign Azure CLI sign-ins and business email disruption. We already tried the temporary trial signup; it required payment card details and warned of paid renewal. Our subscriptions are supplied by a CSP partner, and the original admin center denies support access. Could an official Microsoft representative advise a VERIFIED route to report a suspected TENANT COMPROMISE and request Data Protection / Tenant Recovery assistance without purchasing a new subscription or requiring the missing admin role? We can verify tenant ownership securely and privately. This issue is not resolved.