My organization has no Global Administrator

Manual tenant admin recovery and Global Administrator assignment for a specific tenant or domain cannot be performed directly. To regain or establish administrative control, use the supported recovery and takeover processes:

1. Perform an admin takeover of the unmanaged directory
   • If the tenant lockedingarage.com.au is unmanaged (shadow tenant created via self-service sign-up), a global administrator in the owning organization can take it over by proving DNS ownership.
   • There are two supported methods:
     • Internal admin takeover: Used when there is some level of access to the unmanaged directory (for example, a user account already exists in that tenant). This process assigns the Global Administrator role in that unmanaged directory. No users, domains, or service plans are migrated to another directory.
     • External admin takeover: Used when there is no access to the unmanaged directory. In this case, add the DNS domain name of the unmanaged directory to a managed Microsoft Entra tenant, verify the domain via DNS TXT record, and (optionally) use the -ForceTakeover option. This creates a mapping of users to resources in the managed directory so users can continue to access services.
   • For external admin takeover with Microsoft Graph PowerShell, the documented sequence is:
     1. Connect-MgGraph -Scopes "User.ReadWrite.All","Domain.ReadWrite.All"
     2. Get-MgDomain (review existing domains)
     3. New-MgDomain -BodyParameter @{Id="<your domain name>"; IsDefault="False"}
     4. Get-MgDomainVerificationDnsRecord (retrieve TXT record details and add them at the DNS registrar)
     5. Confirm-MgDomain –DomainName <domainname> (use -ForceTakeover only when required for external takeover)
   • After successful takeover, the domain shows as Verified in the managed tenant. For external takeover with -ForceTakeover, the unmanaged Microsoft Entra organization is deleted 10 days after the takeover.
2. Use self-service admin takeover flows where available
   • For unmanaged tenants created by self-service sign-up (for example, via Power BI), an internal admin takeover can be initiated by signing up with an email address in the target domain and following the admin takeover wizard. This requires the ability to receive mail for that domain and complete email verification.
3. If locked out or unable to complete takeover, open a Microsoft 365 support ticket
   • When no Global Administrator exists or access is lost and automated flows fail, tenant access and ownership recovery is handled only through Microsoft support and the Data Protection Team.
   • The documented guidance is to open a support ticket for tenant access issues. The Data Protection Team can:
     • Reset credentials of an administrator account.
     • Help claim ownership of tenants that belong to the organization.
   • For nonprofit tenants, or when tenant access is lost due to staff turnover or unknown admin credentials, recovery must follow Microsoft’s identity verification process via standard Microsoft 365 support channels. Identity and ownership may be verified using business documentation, domain ownership, or other official records.
4. Important constraints
   • Microsoft for Nonprofits and community channels cannot bypass identity verification or directly assign Global Administrator.
   • All tenant ownership and access decisions are made through Microsoft 365 support after verification.
   • If an internal admin takeover is not possible because there is no access to the unmanaged directory, an external admin takeover or a support ticket is required.

To proceed, use the admin takeover process for unmanaged directories and, if that cannot be completed due to the AADSTS900144 error or other blocking issues, open a Microsoft 365/Azure support ticket and work with the Data Protection/Data Protection Team to regain access and have a Global Administrator established after identity verification.

References:

• Take over an unmanaged directory as administrator in Microsoft Entra ID
• External admin takeover
• Discover your Microsoft cloud footprint FAQ
• Tenant access recovery
• Internal admin takeover
• Troubleshoot common issues with Microsoft Entra B2B collaboration
• Power BI implementation planning: Tenant setup