NEED TO RECOVER GLOBAL ACCOUNT BECAUSE OF LOST MFA ACCESS

PYVN 40 Reputation points
2026-05-09T04:13:56.2533333+00:00

I need help in resetting my authentication method.

I just lost my phone, lost access to MFA and I happen to be the only global admin.

I tried to receive code via phone. But, this option have error with code 399287 (picture)

Can you help to recover my account

Many thanks.

<Mod mask PII>

Microsoft 365 and Office | Subscription, account, billing | For business | Other
Answer accepted by question author
Raja Pothuraju 47,825 Reputation points Microsoft Employee Moderator
2026-05-11T11:07:14.03+00:00

Hello @PYVN,

Thank you for sharing your details via private message.

I’ve reached out to the engineering team regarding the MFA issue on your account. They have now unblocked it from the backend and cleared the bad reputation associated with it. You should be able to log in to the Azure Portal without any issues.

Please try signing in and verify if you can complete SMS authentication successfully. Let me know if you encounter any problems.

As a best practice, I recommend registering the Microsoft Authenticator method for your account instead of relying on SMS. SMS and voice call authentication methods are more vulnerable to IRSF attacks (telephony fraud) and are generally less secure.

For better practice, I recommend registering with Microsoft Authenticator method to your account instead of SMS method as these SMS/Voice telecom auth methods are susceptible to IRSF attacks telephony fraud.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

Was this answer helpful?

1 person found this answer helpful.
Answer accepted by question author
Anonymous
2026-05-09T10:37:13.97+00:00

Please understand that as forum moderators, we do not have the tools or sufficient access to make changes to user accounts, including logging in, resetting passwords, or modifying access rights. For your security, only Microsoft Support can assist with these requests.  

Hello @PYVN,

Thank you for reaching out.

Since you are the only admin, you will need to contact Microsoft’s Data Protection team. This team has the authority and the specific security procedures to verify your identity as the legitimate owner of the account and then reset your MFA settings from their end. Please try to find the related hotline number to call the frontline and let them raise a ticket for you: Customer service phone numbers - Microsoft Support   

User's image

Here are some tips and an example of a prompt to help you navigate the IVR more effectively:   

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help)        

In some regions you may initially interact with an automated system, so here is an example of how you can answer the prompts to reach the right team more quickly:   

  • What kind of problem are you experiencing?           
  • Answer: Authenticator           
  • What products do you use?           
  • Answer: Office 365 for business           
  • Is this for an education or company account?           
  • Answer: For companies           
  • Are you an administrator?           
  • Answer: Yes           
  • Are there any other administrators in your organization?           
  • Answer: No. I am the only admin in my tenant            
  • Do you need a... Service request?            
  • Answer: Yes. I need to create a ticket. Please send me direct to the Data Protection Teams.        

During the call, you will be asked to provide information that verifies your identity and proves ownership of the tenant, such as your organization name, billing information, contact email, phone number, or other subscription‑related details.

If you are unable to reach support via the phone numbers, there is a workaround you might consider: You can register for a new Microsoft 365 tenant by signing up for a trial subscription here: Microsoft 365 Business Plans and Pricing | Microsoft 365    

User's imageUser's image

Once the new tenant is created, you can access the admin center and submit a support ticket from there, requesting to speak with the Data Protection Team on behalf of your original tenant.    

Important notes:     

  • This new trial tenant will not give you access to any of the data or settings in your original locked tenant. It is solely a temporary means to contact Microsoft support.    
  • The resolution time might be longer as you are contacting support from a different tenant.    
  • Remember to cancel the trial subscription for the new tenant once your issue with the original account is resolved to avoid any unintended charges.  

I hope the information provided helps guide you in the right direction. Although I’m unable to take direct action, I sincerely hope that the steps and recommendations I’ve shared can support you through the process.  

Warm regards, 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Was this answer helpful?

1 person found this answer helpful.
0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-05-09T04:14:15.51+00:00

    Because the account is a work/school (tenant) account, and there is only one global admin who has lost access to all MFA methods (Authenticator and SMS with error 399287), recovery must go through Microsoft support and the Data Protection/Tenant Recovery process. It cannot be fixed from the sign-in page alone.

    Use the following supported paths:

    1. If there is any other global admin in the tenant
      • Another global admin can reset MFA so the affected admin can re-register methods:
        1. Sign in to the Azure portal as another global admin.
        2. Open Microsoft Entra ID → Users.
        3. Select the locked-out user.
        4. Go to Authentication methods and select Require re-register multifactor authentication.
        5. Next sign-in for that user will prompt for fresh MFA registration.
    2. If there is no other global admin (sole admin locked out)
      • A Data Protection/Tenant Recovery case is required. The pattern from similar resolved cases is:
        1. Call Microsoft Global Customer Service using the country-specific phone number listed on the official support page ("Customer service phone numbers - Microsoft Support").
        2. When interacting with the IVR/agent, clearly state:
          • The product: Microsoft 365/Office 365 for business (work or school account).
          • That this is an admin lockout: the only global administrator has lost MFA and cannot access the admin portal.
          • Request creation of a service request and escalation to the Data Protection or Tenant Recovery team to reset MFA registration.
        3. Be prepared to provide tenant and identity proof (business details, domain, contact info, etc.) as requested by the Data Protection engineer.
        4. After verification, the Data Protection team will reset or clear MFA for the admin account so that new authentication methods can be registered at next sign-in.
    3. If phone support is hard to reach
      • As used successfully in another case, create a temporary trial tenant:
        1. Sign up for a Microsoft 365 Business trial to create a new tenant and admin.
        2. From that new tenant’s admin center, open a support ticket requesting to speak with the Data Protection team on behalf of the original locked-out tenant, explaining that the only global admin has lost MFA.

    Once access is restored, add multiple MFA methods (Authenticator on more than one device, phone call/SMS, and possibly a FIDO2/security key) and create at least one additional global admin or break-glass account to avoid future tenant lockouts.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.