A cloud-based identity and access management service for securing user authentication and resource access
Use depends on whether there is another Global Administrator in the tenant.
- If there is another Global Admin Ask that admin to reset the MFA registration so the account can be set up again:
- The other admin signs in to the Azure portal and opens the Microsoft Entra admin center.
- Go to Identity > Users > All users.
- Select the locked-out user account.
- Open Authentication methods.
- Select Require re-register multifactor authentication.
- Sign in again with the affected account and complete MFA registration on the new device.
This is the standard way to reset MFA for a user whose phone/app is lost or broken.
- If there is NO other Global Admin (only admin is locked out) This is a tenant lockout scenario. In that case, only Microsoft Support (Data Protection / Tenant Recovery team) can reset MFA after verifying tenant ownership.
Because sign-in is blocked and a support ticket in the portal cannot be created, use one of these paths from similar resolved cases:
Option A – Call Global Customer Service (preferred)
- Call the regional Customer service phone numbers - Microsoft Support listed in the documentation.
- When the IVR/automated system asks, clearly state:
- Issue: “Authenticator / Multi-Factor Authentication reset.”
- Product: “Office 365 for business” or “Microsoft 365 for business” (company account).
- Confirm: “Yes, administrator” and “No, there is no other administrator.”
- Ask: “I need to create a ticket and be transferred to the Data Protection Team for tenant recovery and MFA reset.”
- Once connected to an agent, explain that:
- The only Global Admin is locked out due to MFA.
- The tenant is still being billed but cannot be accessed.
- A Data Protection / Tenant Recovery case is required to reset MFA.
Support will then validate identity/ownership (business docs, domain, billing info, etc.) and perform the MFA reset on the admin account.
Option B – Create a temporary tenant to open a ticket (workaround)
If it is impossible to reach a live agent via phone:
- Sign up for a new Microsoft 365 tenant using a trial subscription.
- In that new tenant, sign in to the admin center as Global Admin.
- From there, create a support request asking to speak with the Data Protection team on behalf of the original (locked) tenant and request an MFA reset for the only Global Admin.
Support will then contact back and proceed with verification and recovery for the original tenant.
These are the supported recovery paths when an admin is locked out by MFA and cannot open a ticket from the affected tenant.
References:
- Can't use Azure Multi-Factor Authentication to sign in to cloud services after you lose your phone or the phone number changes
- Common problems with two-step verification for a work or school account
- Create an Azure support request
- I need to reset my mfa methods - Microsoft Q&A
- Requesting a Tenant Admin MFA Reset - Microsoft Q&A
- Reset Personal Azure MFA - Microsoft Q&A
- Global Admin Locked out - Microsoft Q&A
- Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A