Follow these steps depending on the exact situation in the tenant.
- If there is another global admin in the tenant
- Ask that global admin to reset the multifactor authentication registration for the locked-out account.
- The other admin should:
- Sign in to the Azure portal and open Microsoft Entra ID.
- Go to Users and select the affected user account.
- Open Authentication methods.
- Select Require re-register multifactor authentication.
- After this, sign in again; the portal will prompt to set up MFA (for example, Microsoft Authenticator) from scratch.
- If there is no other global admin (only one admin on the tenant)
- Use the official escalation path for locked-out global admins:
- If this is a Partner/organization tenant, follow the guidance under Solve account access problems:
- If the account is the only global admin, contact the Azure Data Protection team at the phone number listed in the documentation.
- If the company has no global admin, contact the Microsoft 365 Data Protection team via the regional support number listed under Get support - Microsoft 365 admin and request help to reset the password or restore access.
- These teams can verify ownership of the tenant and help reset access when self-service and in-tenant admin recovery are not possible.
- If the issue is that the account itself cannot sign in anywhere (password/MFA problems)
- If self-service password reset (SSPR) is enabled, use the security info method to reset the work or school password: see "Reset your password using security information" in the documentation.
- If SSPR is not enabled or does not work, use the Data Protection escalation paths described above.
- Prevent future lockouts once access is restored
- Configure more than one MFA method (for example, Microsoft Authenticator plus phone or another method) so a single device loss does not block access.
- Create an emergency access (break-glass) account in Microsoft Entra ID with appropriate protections so that administrative access is still possible if normal accounts lose MFA access.
References: