Global Admin locked out – MFA reset needed (tenant PII)

For a single Global Administrator who is fully locked out due to MFA (error 500121) with no alternative methods, the only supported path is recovery through Microsoft support and the Data Protection / Tenant Recovery process. Community moderators and forums cannot directly reset MFA or access the tenant.

Follow these steps:

1. Contact Microsoft support by phone
   • Call Microsoft Global Customer Service for business: use the numbers listed under Customer service phone numbers - Microsoft Support.
   • Clearly state during the IVR and to the agent:
     • This is an Office 365 / Microsoft 365 for business tenant.
     • It is a company (work) account, not personal.
     • The caller is the only Global Administrator for the tenant unifysystem.it.
     • The issue is a tenant lockout due to MFA (Microsoft Authenticator removed, no backup methods, error code 500121).
     • A Data Protection / Tenant Recovery case is needed to reset the admin’s MFA methods.
   Example flow (from existing guidance):
   • When asked what the problem is: say “Authenticator”.
   • Product: “Office 365 for business”.
   • Account type: “For companies”.
   • Are you an administrator? “Yes.”
   • Do you have another administrator? “No.”
   • When asked if a service request is needed: “Yes, I need to create a ticket and speak with the Data Protection team.”
2. Prepare verification information The Data Protection team will require proof of ownership/administrative control. Be ready to provide, as requested:
   • Domain ownership proof (for example, adding a DNS TXT record on unifysystem.it).
   • Official business documentation (registration, tax or company documents matching the tenant organization name).
   • Contact details that match public or tenant records.
3. If phone support is hard to reach
   • As an alternative, create a temporary trial tenant (for example, a Microsoft 365 Business trial) and use that new tenant’s admin center to open a support ticket.
   • In the ticket, clearly state that the request is on behalf of the existing tenant unifysystem.it, that the only Global Admin is locked out due to MFA, and that a Data Protection / Tenant Recovery escalation is required.
4. What Microsoft for Nonprofits or partners can and cannot do (if applicable)
   • If a partner manages the tenant and has GDAP with the Privileged Authentication Administrator role, they can reset MFA and password directly.
   • If no such partner access exists, or no one can sign in with sufficient rights, Microsoft must work directly with the tenant’s Global Admin through the Data Protection process.

Until Microsoft completes identity verification and resets the MFA methods, access to the tenant cannot be restored by any self-service or community mechanism.

References:

• Tenant access recovery
• Preventing tenant lockouts
• Tenant Lockout: Scenarios & Next Steps
• GDAP frequently asked questions
• All about passwords
• Mandatory multifactor authentication for Azure and admin portals
• Global Admin Locked out - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A
• Microsoft authenticator sending me into a spiral - Microsoft Q&A
• About administrator roles in the Microsoft 365 admin center