Sole Global Administrator locked out by MFA – need Data Protection team reset

Question

Sole Global Administrator locked out by MFA – need Data Protection team reset

David Queen 0

I am the only Global Administrator of my Microsoft 365 Business Basic tenant.

Sign-in: [Moderator note: Personally Identifiable Information removed]@getmarkaioffice.com (originally [Moderator note: Personally Identifiable Information removed].onmicrosoft.com)

Organization name: [Moderator note: Personally Identifiable Information removed]

Verified domain: getmarkaioffice.com

While setting up Microsoft Authenticator, the registration did not complete. The

account receives no requests in the app, and the phone-call method that worked

earlier no longer appears. Sign-in only offers the Authenticator app. There is no

other admin on the tenant.

I can prove ownership: I pay the Microsoft invoices on this tenant, and I control

DNS for getmarkaioffice.com and can add any TXT record you give me.

Please escalate to the Data Protection team to reset MFA on this account.

0 comments

2 answers

Your answer

Answer 1

Microsoft Q&A cannot reset the account or escalate the case directly; contact Microsoft 365 business support and request a Data Protection/Tenant Recovery case for a sole Global Administrator locked out by MFA.^1^

Open the recovery case

Open Microsoft’s country/region support-number directory and call the applicable Microsoft 365 for business number: ^2^
In the automated prompts, choose:
- Business
- Microsoft 365 / Office 365
- Technical support
- Administrator
Tell the agent:

This is a Microsoft 365 Business tenant lockout. I am the sole Global Administrator. The password works, but the Authenticator registration is unusable, no alternate MFA method is offered, and there is no other administrator. Please create a service request for the Data Protection/Tenant Recovery team to verify tenant ownership and reset the administrator’s authentication methods.
Obtain and retain the service-request number. If routed to consumer support or password recovery, clarify that this is a work/business tenant, not a personal Microsoft account, and that the requested operation is an MFA authentication-method reset after tenant ownership verification.

A closely matching sole-administrator lockout case confirms that account changes cannot be performed through the forum and that Data Protection handles identity verification and recovery when no other administrator can reset MFA.^3^

Prepare for ownership verification

Do not post any of this information publicly. Have it ready to provide privately to the assigned support engineer:

Tenant’s original *.onmicrosoft.com domain
Affected Global Administrator sign-in name
Organization and subscription details
Recent invoice/order information and billing details
Alternate reachable email address and telephone number
Access to the verified domain’s public DNS
Ability to add a requested DNS TXT record
Any existing Microsoft support case number

Support—not forum moderators—must specify the actual verification record or evidence required. Do not add a guessed TXT record.

Conditional alternative: authorized Microsoft partner

If the subscription was purchased through a Cloud Solution Provider or another partner, ask whether that partner has an active GDAP relationship:

A partner with the appropriate authentication-reset role may be able to restore access directly.
A partner with the Service Support Administrator role can create the support request on your behalf.
For a Data Protection case, Microsoft still works directly with the affected customer, so the partner should include the locked-out administrator’s alternate contact details.^1^

Without an appropriately authorized GDAP partner, continue through Microsoft business support; creating another user or resetting this account from the tenant is unavailable while the only administrator remains locked out.

After access is restored

Re-register the affected administrator’s authentication methods.
Create at least two cloud-only emergency-access accounts using the tenant’s *.onmicrosoft.com domain.
Use strong authentication methods that differ from the normal administrator’s method.
Store credentials securely, monitor their sign-ins, and test them regularly.
Ensure emergency accounts are not blocked by Conditional Access policies intended for ordinary accounts.

Microsoft recommends two or more emergency-access accounts specifically to reduce the risk of losing administrative access when MFA devices or services are unavailable.^4^

References

Answer 2

Hi David,

I hope you're doing well.

I'm sorry to hear about the loss of access to your Microsoft 365 Global Administrator account after the Microsoft Authenticator registration did not complete.

Unfortunately, moderators and community members are unable to create support tickets or directly escalate cases to the Microsoft Data Protection team on your behalf. The Data Protection team can only be engaged through Microsoft Support after the appropriate identity and ownership verification process has been completed.

Based on your description, you are the sole administrator of the tenant, your account only offers an Authenticator app that never received the registration, and no alternative MFA method or additional administrator account is available. This occurs because the unfinished setup left the app as the only accepted verification method, even though it was never fully linked to your account. In this situation, the supported recovery path is to work directly with Microsoft Support so they can initiate the account recovery and verification process.

You may try contacting Microsoft Support by phone using the regional contact numbers listed here: Customer service phone numbers - Microsoft Support

I understand that you have already contacted Microsoft Support by phone without success. Please try the following option, and I sincerely hope it helps resolve the issue for you.

User's image

In this situation, the Microsoft Data Protection team has tools and processes in place to verify identity and regain access to administrator accounts.

Here are some tips and an example of a prompt to help you navigate the IVR more effectively:

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)

In some regions, the initial interaction may be automated, so here’s a general idea of how the conversation might go to help you prepare:

What kind of problem are you experiencing?
Answer: Authenticator
What products do you use?
Answer: Office 365 for Business
Is this for an education or company account?
Answer: For companies
Are you an administrator?
Answer: Yes
Are there any other administrators in your organization?
Answer: No. I am the only admin in my tenant
Do you need a... Service request?
Answer: Yes. I need to create a ticket. Please send me directly to the Data Protection Teams.

During the phone call, you will need to provide the information associated with your subscription, such as your company name, billing details, phone number, and an alternate email address, etc. This information allows the Data Protection team to verify your identity and securely assist you in regaining access to your administrator account.

I also recommend calling during business hours. In my experience, it can be difficult to get through to the correct support queue, and automated systems don't always work as expected. If you can't get through on your first try, I suggest trying again later or at a different time.

Alternative option if you cannot reach frontline support:

If you're unable to successfully engage support through the phone system, you might consider registering for a new tenant by signing up for a trial subscription.

To set up a new tenant, please follow these steps:

Visit Microsoft 365 Business Plans and Pricing | Microsoft 365. This will allow you to create a new tenant following the prompts provided. Once set up, you can access the admin console of the new tenant and submit a support ticket requesting to speak with the Data Protection team on behalf of your previous tenant.

Follow the guided setup process to create a new account for a new tenant.

Once your tenant is created, you should be able to access the support portal and submit your ticket referencing your locked account without further issues.
Ticket Support: In the Microsoft 365 Admin Center > Support > Help & Support.
You may refer to the following guide for detailed instructions on how to contact Microsoft Support and open a support case: Get support - Microsoft 365 admin | Microsoft Learn

Please remember to cancel the trial subscription after your issue is resolved, as this will help you avoid any accidental billing. You may prefer the following resource for detailed instructions: Cancel your Microsoft business subscription in the Microsoft 365 admin center | Microsoft Learn

I truly hope this helps you regain access to your account quickly. Even though I can't directly intervene, directing you to the correct and specialized support is the most effective help I can provide from my position.

Should you have any further questions, please feel free to let me know.

Warm regards.