A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation
Because the phone was changed and Microsoft Authenticator is no longer available, access to the work or school account (the @company.onmicrosoft.com account used to view invoices) is blocked by MFA.
To regain access, the MFA methods must be reset or re-registered. The available options depend on whether there are other admins in the tenant:
- If there is another global admin in the organization
- That admin can reset the MFA settings so the account can be set up again on the new phone.
- They should follow guidance similar to:
- Go to the Microsoft Entra admin portal.
- Open the user account.
- Use the option to require re-registering multifactor authentication so that new methods (such as the new Authenticator app instance or phone) can be configured.
- If this is the only admin account in the tenant
- This is a tenant lockout scenario. In such cases, the Microsoft Data Protection team must be involved to restore access.
- Use the Microsoft Customer Service phone numbers and request a ticket with the Data Protection team, clearly stating:
- This is a business/Office 365 for business tenant.
- The caller is the only global admin.
- Access is lost due to Microsoft Authenticator on a replaced phone.
- The Data Protection team has tools and processes to verify identity and help regain access to the administrator account so invoices and other tenant resources can be accessed again.
If direct contact to support is difficult, one documented workaround is to create a temporary trial Microsoft 365 tenant, use its admin center to open a support ticket, and ask support to connect with the Data Protection team for the original locked tenant. This does not give access to the original tenant’s data but provides a channel to Microsoft support to resolve the lockout.
Once MFA is reset and access is restored, set up Microsoft Authenticator again on the new phone using the official download and setup guidance, and consider configuring an additional MFA method (such as phone) to avoid future lockouts.
References:
- Troubleshoot problems with Microsoft Authenticator
- Download Microsoft Authenticator
- Common problems with two-step verification for a work or school account
- I have a new mobile phone and I want to add it to MFA
- I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work.
- I need to reset my mfa methods
- Microsoft authenticator sending me into a spiral
- Requesting a Tenant Admin MFA Reset
- Severity A Situation - Locked out of global admin account (MFA) - business down
- Work or school account help