Unable to complete sign-in process

Because the only Global Administrator cannot complete MFA, contact Microsoft Support by phone and request Microsoft Entra tenant-lockout recovery with ownership verification and MFA re-registration for the designated Global Administrator. Microsoft’s documented process is to verify tenant ownership and restore access to the existing tenant—not create a replacement tenant.^1^

Open the recovery case

1. Use Microsoft’s business-support contact list and call the number for your country or region.^2^
2. Describe the case precisely:

   Microsoft 365 business tenant lockout. The affected account is the sole Global Administrator. The password is accepted, but MFA cannot be completed after Microsoft Authenticator was reinstalled. No administrator is available to reset the authentication methods. We need tenant-ownership verification and recovery of the existing tenant.

3. Ask the agent to create a case against the locked tenant and route it to the team handling Data Protection/tenant recovery. Matching sole-administrator MFA-lockout cases require this escalation.^3^
4. Record the support case number and provide a reachable external email address and telephone number.

Prepare the following without posting it publicly:

• Tenant’s *.onmicrosoft.com name and tenant ID, if known
• Affected Global Administrator username
• Custom domain name and ability to modify its DNS records
• Subscription details, invoices, and billing information
• Registered organization information
• An external contact email and telephone number

Microsoft uses a high-assurance verification process before recovering the designated administrator’s access.^1^

Faster paths if available

• Another sign-in method appears: Select Other verification options and use a previously registered method. This only applies if another method is actually offered.^4^
• A Microsoft partner manages the tenant through active GDAP: Ask that partner to check its active roles. A partner with the appropriate authentication-reset role can restore access; one with Service Support Administrator can submit the recovery request on your behalf. Microsoft’s Data Protection team will still work directly with your organization for verification.^5^
• Telephone support cannot create the case: As a workaround, create a temporary Microsoft 365 trial tenant, sign in to its admin center, then go to Support → Help & Support → Contact support. State that the ticket concerns a different, locked tenant and request Data Protection/tenant recovery. Cancel the trial after the recovery case is resolved to avoid renewal charges.^6^

After access is restored

1. Re-register the administrator’s authentication methods.
2. Create administrative redundancy. Microsoft recommends two cloud-only emergency-access accounts permanently assigned the Global Administrator role.^7^
3. Give those accounts distinct credentials and authentication methods, monitor their sign-ins, and document the emergency-access procedure.^5^

Do not publish tenant identifiers, invoices, administrator addresses, or ownership documents in this Q&A thread; provide them only through the Microsoft support case.

References

1. Plan for tenant recoverability
2. Contact Microsoft customer support
3. Global Administrator Locked Out | MFA Reset request. On behalf of a Microsoft Business 365 Account - Microsoft Q&A
4. You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
5. Preventing tenant lockouts
6. Sole Global Administrator locked out due to MFA / Microsoft Authenticator – Tenant Recovery required - Microsoft Q&A
7. Add and manage admin accounts