A cloud-based identity and access management service for securing user authentication and resource access
Because the only admin account is locked by MFA and no ticket can be raised from that tenant, recovery must go through Microsoft support/Data Protection.
Use these approaches:
- Try any alternative MFA methods first
- On the sign-in page, if “Sign in another way” is shown, select it and try any other verification option that was previously configured (SMS, call, backup phone, etc.).
- If SMS or call options fail, verify that the phone numbers in the account are correct once access is regained, as incorrect numbers can cause “having trouble verifying your account” errors.
- If there is another Global Admin in the tenant
- That admin can sign in to the Azure portal → Microsoft Entra ID → Users → select the locked account → Authentication methods → choose Require re-register multifactor authentication.
- After this, the next sign-in will prompt for fresh MFA registration.
- If this is the only admin account (single-admin tenant)
In a single-admin scenario (common with student or small tenants), the Microsoft Data Protection team must verify identity and reset MFA: Option A – Call Microsoft support (recommended)- Call the regional number listed under Customer service phone numbers - Microsoft Support.
- In the IVR/agent conversation, clearly state:
- The issue is with Authenticator / MFA.
- The product is Office 365/Azure for business (work/school account).
- It is a company/education account, and this is the only admin account.
- Request creation of a service request with the Data Protection team to reset admin MFA / recover tenant access.
If reaching the right support queue by phone is difficult:- Sign up for a new Microsoft 365 or Azure trial to create a separate temporary tenant.
- In that new tenant, go to the admin center → Support → Help & support and open a ticket.
- In the ticket, state that the real problem is a different existing tenant (the student tenant) where the only Global Admin is locked out by MFA, and request escalation to the Data Protection / Tenant Recovery team.
- Provide the locked tenant’s domain, admin UPN, and error messages.
- After resolution, cancel the trial to avoid charges.
Only Microsoft support/Data Protection can reset MFA for a single locked Global Admin when no other admin exists and portal access is impossible.
References:
- I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
- Requesting a Tenant Admin MFA Reset - Microsoft Q&A
- Global Admin Locked out - Microsoft Q&A
- I need to reset my mfa methods - Microsoft Q&A
- Use a screen reader to set up and troubleshoot multifactor authentication
- You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
- "Account verification system is having trouble" error message when you try to sign in by using a work or school account
- Common problems with two-step verification for a work or school account
- "Activation failed" error when you try to set up Azure Multi-Factor Authentication