Global admin locked out - lost MFA access

Follow these steps based on the situation described (only global admin, no MFA access, cannot sign in):

1. Confirm there is truly no other admin
   • If there is any other Global Administrator or Privileged Authentication Administrator on the tenant, that person can reset the locked-out admin’s password/MFA.
   • Guidance recommends having at least one other admin who can reset a Global Administrator’s password or MFA.
2. If there is another admin (even a partner with GDAP and the right roles)
   • An admin with appropriate Entra ID roles (for example, Global Administrator, Privileged Role Administrator, or roles that can reset passwords) should:
     1. Sign in to the Microsoft Entra admin center.
     2. Go to Users → select the locked-out account.
     3. Use Authentication methods → Require re-register multifactor authentication to force MFA re‑registration.
     4. If needed, reset the password as well.
   • If a partner has an active GDAP relationship with the tenant and holds password reset roles, the partner should work directly with the customer to restore access; there is no need to contact Microsoft in that case.
3. If there is no other admin and no partner with the right GDAP roles (your case)
   • This is a tenant lockout scenario where the only Global Administrator has lost MFA and cannot access the tenant.
   • In this situation, recovery must go through Microsoft’s Data Protection / Tenant Recovery process.
   Use one of these supported paths: Option A – Call Microsoft Data Protection / Microsoft 365 support (primary path)
   1. Call Microsoft support using the business support numbers for your region: see Find Microsoft 365 for business support phone numbers by country or region.
   2. When connected to the IVR/agent, clearly state:
      • This is a business/tenant account (Microsoft 365 for business / company account).
      • You are the only Global Administrator.
      • You are locked out due to lost MFA device and cannot access the admin portal to open a ticket.
      • You need to be transferred to the Microsoft 365 Data Protection team (or Data Protection / Tenant Recovery) to reset MFA / restore access.
   3. The Data Protection team will verify tenant ownership and then help reset MFA or otherwise restore access to the global admin account.
   Option B – If you absolutely cannot reach the right support queue
   • As described in similar resolved cases, one workaround is:
     1. Create a temporary new tenant by signing up for a Microsoft 365 trial subscription.
     2. In that new tenant, sign in as its admin and open a support request from the Microsoft 365 admin center.
     3. In the ticket, request to speak with the Data Protection team on behalf of the locked tenant, explaining that you are the only Global Administrator of the original tenant and have lost MFA access.
4. If a partner relationship exists but no GDAP/password-reset roles
   • A partner without the necessary GDAP roles cannot reset your password/MFA.
   • In that case, the guidance is:
     • First, attempt the Self Service Password Reset tool (https://passwordreset.microsoftonline.com/) if configured.
     • If that fails and you remain locked out, the tenant’s Global Administrator (you) must contact Microsoft support as above to work with the Data Protection team.
5. Prevent this in the future (after recovery)
   • Add at least one additional admin (for example, another Global Administrator or Privileged Authentication Administrator) so someone else can reset your password/MFA if you are locked out.
   • Configure multiple MFA methods (Authenticator app, phone, etc.) and ensure at least one emergency/break-glass account is excluded from strict Conditional Access policies so the tenant can always be recovered.

Immediate next action for this urgent case: call Microsoft 365 business support for your region and ask to be routed to the Data Protection team for a tenant lockout / only global admin lost MFA scenario.

References:

• Troubleshoot sign-in issues and account access problems
• Preventing tenant lockouts
• About administrator roles in the Microsoft 365 admin center
• Can't use Azure Multi-Factor Authentication to sign in to cloud services after you lose your phone or the phone number changes
• Common problems with two-step verification for a work or school account
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• Global Admin Locked out - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A
• Microsoft authenticator sending me into a spiral - Microsoft Q&A