MFA reset for Global Admin in Microsoft 365 tenant (locked out)

To break the Microsoft Authenticator loop (sign-in asks for a code from an Authenticator that cannot be accessed), the MFA methods must be reset so that new methods can be registered.

Use the path that matches the situation:

1. If there is another Global Administrator in the tenant
   1. Another global admin signs in to the Azure portal and opens Microsoft Entra ID.
   2. Go to Users > select the locked-out account.
   3. Open Authentication methods.
   4. Select Require re-register multifactor authentication.
   5. Next time the locked-out admin signs in, the account will be prompted to set up MFA again (e.g., re-add Microsoft Authenticator or add a phone/SMS method).
2. If the locked-out account is not an admin (end user)
   1. Contact the organization’s Microsoft 365/Entra administrator or Help desk.
   2. Ask them to open the user in Microsoft Entra ID → Users → user → Authentication methods and select Require re-register multifactor authentication so the MFA setup can be done again.
3. If the locked-out user is the only Global Administrator
   1. This is a tenant lockout scenario; no one else can reset MFA from the portal.
   2. Contact Microsoft Support/Data Protection by phone using the global customer service numbers and request a tenant admin MFA reset / tenant recovery. The Data Protection team will verify tenant ownership and reset the admin’s MFA so that new methods can be registered.
   3. If reaching support is difficult, one documented workaround is to create a temporary trial tenant, use its admin center to open a support ticket, and ask to be connected to the Data Protection team for the original tenant.
4. If there are alternative MFA methods already configured
   1. On the MFA prompt, choose Other verification options if available.
   2. Use SMS, phone call, or another method to sign in.
   3. Once signed in, go to the security info page (for example, https://aka.ms/mysecurityinfo) and add or update methods (such as a new phone number or re-registering Microsoft Authenticator).

If no alternative method exists and no other admin can reset MFA, only Microsoft Support/Data Protection can unlock the loop by resetting the MFA registration.

References:

• Can't use Azure Multi-Factor Authentication to sign in to cloud services after you lose your phone or the phone number changes
• Can't set up MFA because five devices are already registered to use an authenticator app
• Common problems with two-step verification for a work or school account
• Use a screen reader to set up and troubleshoot multifactor authentication
• Global Admin Locked out - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• Microsoft authenticator sending me into a spiral - Microsoft Q&A
• You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
• Microsoft Curate - Troubleshoot Multi-Factor Authentication (MFA)
• Microsoft Monetize - Troubleshooting MFA