A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation
Because the only admin account is locked behind Microsoft Authenticator on a phone that was reset, this is a tenant lockout scenario that cannot be fixed self‑service. Recovery must go through Microsoft support and the Data Protection team.
Use these steps:
- Contact Microsoft support by phone and request Data Protection team
- Call the appropriate number from Customer service phone numbers - Microsoft Support (commercial support line).
- When the IVR/agent asks about the issue, clearly state that:
- This is an Authenticator / MFA problem.
- The product is Office 365/Microsoft 365 for business.
- It is a company/work account.
- The caller is the only global admin and is locked out because the phone with Microsoft Authenticator was reset.
- A service request is needed and it must be escalated to the Data Protection team to reset MFA for the tenant admin.
- Be prepared to provide tenant details (admin sign‑in name, domain, business details, contact info) and complete identity verification. The Data Protection engineers will then work with the caller to reset/re‑register MFA and add an additional auth method.
- If phone support cannot be reached, create a temporary trial tenant to open a ticket
- Sign up for a new Microsoft 365 trial tenant (separate from the locked one).
- In the new tenant, go to the Microsoft 365 admin center → Support → Help & support.
- Open a support ticket explaining:
- The ticket is about a different existing tenant where the only global admin is locked out due to Microsoft Authenticator on a reset phone.
- Include the locked tenant’s domain, admin UPN, and error behavior (MFA loop, no access to Authenticator).
- Request escalation to the Data Protection team to reset MFA for the original tenant’s admin.
- After the original tenant is recovered, cancel the trial subscription for the temporary tenant to avoid charges.
Once the Data Protection team verifies identity, they can reset MFA on the admin account so a new phone and new authentication methods can be configured.
References:
- I have a new mobile phone and I want to add it to MFA
- Microsoft Authenticator FAQs
- Troubleshoot signing in with a passkey
- Troubleshoot problems with Microsoft Authenticator
- I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
- How Do I Regain Access to My Account After Losing Access to Microsoft Authenticator? (Urgent Request). - Microsoft Q&A
- Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
- Requesting a Tenant Admin MFA Reset - Microsoft Q&A
- I need to reset my mfa methods - Microsoft Q&A