Tenant sole global admin cannot login due to MFA issue.

Question

Tenant sole global admin cannot login due to MFA issue.

Napa.C 115

I am having trouble with logging in to M365 admin center due to MFA issues.

My old MFA device broke, I got a new one and now I cannot authenticate myself and I did not setup backup method.
The user is the only global admin of the Tenant.
Tried contacting Microsoft Data Protection Team via the phone number but could not get pass the AI

Please help me contact the Data Protection Team, I can provide more details in private chat.

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-04T03:59:45.49+00:00

Hello Napa.C

Based on the details you’ve shared, this appears to be a tenant lockout scenario.

To resolve this, the recommended approach is to contact the Microsoft Data Protection team. You can reach them by calling Microsoft Customer Service using the phone numbers listed here: https://support.microsoft.com/en-us/topic/customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2

If you have access to another tenant or subscription where you still have Global Administrator privileges, you may also raise a support request from there to get assistance in restoring access to the affected tenant.

For future reference and to help prevent tenant lockouts, please check: Preventing tenant lockouts - Microsoft Learn.

If neither option is possible, please don’t worry—let us know, we are happy to assist you further!
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-11T09:53:06.67+00:00

Hello Napa.C Following up to see if you were able to create the support ticket, otherwise please let us know, we are happy to assist you further!

1 answer

Your answer

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-04T03:59:45.49+00:00

Hello Napa.C

Based on the details you’ve shared, this appears to be a tenant lockout scenario.

To resolve this, the recommended approach is to contact the Microsoft Data Protection team. You can reach them by calling Microsoft Customer Service using the phone numbers listed here: https://support.microsoft.com/en-us/topic/customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2

If you have access to another tenant or subscription where you still have Global Administrator privileges, you may also raise a support request from there to get assistance in restoring access to the affected tenant.

For future reference and to help prevent tenant lockouts, please check: Preventing tenant lockouts - Microsoft Learn.

If neither option is possible, please don’t worry—let us know, we are happy to assist you further!
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-11T09:53:06.67+00:00

Hello Napa.C Following up to see if you were able to create the support ticket, otherwise please let us know, we are happy to assist you further!

Answer 1

Because the only global admin on the tenant is locked out by MFA and self-service options or other admins are not available, the situation must be handled by Microsoft’s Data Protection team through a support case. Forum moderators and community tools cannot directly contact that team or access the tenant.

Use these steps, based on the documented and Q&A-supported process:

Call Microsoft’s global customer service / business support number
- Use the regional number listed under Customer service phone numbers - Microsoft Support or Find Microsoft 365 for business support phone numbers by country or region.
- These front-line agents are the entry point; they must create a ticket and route it to the Data Protection team.
Navigate the IVR so the call reaches Data Protection When the automated system asks questions, answer along these lines (wording from the documented examples):
- Problem type: say “Authenticator”.
- Product type: say “Office 365 for business”.
- When asked: education or company account? answer “For companies”.
- When asked if an administrator: answer “Yes”.
- When asked if there is another administrator: answer “No”.
- When asked if a service request is needed: answer “Yes, I need to create a ticket. Please send me directly to the Data Protection Team.”
Clearly state the scenario to the agent When connected to a live agent, clearly explain:
- This is a Microsoft 365 business / Entra ID tenant.
- The caller is the only global administrator.
- The MFA device was lost/broken, no backup method is configured, and sign-in is blocked at the MFA step.
- Self-service password reset and normal MFA reset paths are not available because there is no other admin. Ask explicitly for the case to be escalated to the Microsoft Data Protection team to verify identity and reset MFA / restore access.
If the IVR blocks progress repeatedly If the call flow still does not reach a human agent or the correct queue:
- Try calling again and choose the business / technical support options as described above.
- If still unsuccessful, create a temporary trial tenant and open a ticket from there, as described in the Q&A guidance:
  1. Sign up for a Microsoft 365 trial to create a new tenant.
  2. Go to the Microsoft 365 admin center of the new tenant.
  3. Use Support → Help & support to open a ticket.
  4. In the ticket, clearly state that:
    - The issue concerns a different, existing tenant where the caller is the only global admin.
    - The admin is locked out due to MFA on a broken device with no backup method.
    - A Data Protection team review and MFA reset are required.
- This trial tenant is only a channel to reach support; it does not give access to the locked tenant’s data.
If the tenant is under a partner / reseller
- If the Microsoft 365 subscription was obtained through a partner or CSP, that partner can open a service request on behalf of the tenant.
- The partner should use their GDAP relationship (if present) and follow the “tenant lockout” guidance to work with Microsoft support.

Only Microsoft support (specifically the Data Protection team) can verify identity and reset MFA for a sole global admin who is locked out. Continue working through the phone support or a trial-tenant support ticket until a Data Protection case is created.

References: