URGENT: Complete Tenant Lockout / MFA Reset Required for Global Admin

Question

URGENT: Complete Tenant Lockout / MFA Reset Required for Global Admin

Syed Mohd Ali 0

Hello,

I am experiencing a complete tenant lockout on my personal Azure/Entra ID account.

I am the sole Global Administrator for this tenant. The Azure portal is prompting me for a 6-digit Authenticator code, but my app only has my personal 8-digit profile. I am not receiving push notifications, and there are no alternative sign-in methods available on the "Verify your identity" screen (no SMS or email backup).

Because I am the only admin and have no other ways to verify, I am caught in an MFA loop and cannot access my Azure resources.

I am trying to log into my personal Azure subscription. After the initial authentication, it asks for a code from Authenticator.

The Authenticator app shows 8‑digit codes, but Azure expects 6‑digit codes - Push notifications never arrive - “Use another verification option” doesn’t appear - The MFA reset page ([aka.ms/mfasetup]) only works for work/school accounts.

I tried clicking “I can’t use my authenticator app right now.” - Appears to be Azure MFA profile is likely stuck.

Need help to reset personal azure MFA for my account

Please escalate this ticket immediately to the Data Protection Team so they can verify my identity and perform a backend MFA reset for my Entra ID tenant.

Best regards,
Syed Ali

Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator

2026-05-11T02:47:50.8366667+00:00

Syed Mohd Ali

Based on the details you’ve shared, this appears to be a tenant lockout scenario.

To resolve this, the recommended approach is to contact the Microsoft Data Protection team. You can reach them by calling Microsoft Customer Service using the phone numbers listed here: https://support.microsoft.com/en-us/topic/customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2

If you have access to another tenant or subscription where you still have Global Administrator privileges, you may also raise a support request from there to get assistance in restoring access to the affected tenant.

For future reference and to help prevent tenant lockouts, please check: https://learn.microsoft.com/en-us/partner-center/customers/gdap-preventing-tenant-lockouts

If neither option is possible, please don’t worry—let us know, we are happy to assist you further!
Syed Mohd Ali 0 Reputation points

2026-05-11T07:18:23.13+00:00

Hi @Shubham Sharma

I called the support, they asked me to create ticket on the azure site, however I am locked out of it so I cannot create the ticket. Can you support me here please?
Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator

2026-05-12T08:05:55.9566667+00:00

Syed Mohd Ali

To proceed, I will need a few details from you. As this information contains Personally Identifiable Information (PII), please share the following details in private message only:

Please send me the detail via private message. So, we can assist you further.

1 answer

Your answer

Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator

2026-05-11T02:47:50.8366667+00:00

Syed Mohd Ali

Based on the details you’ve shared, this appears to be a tenant lockout scenario.

To resolve this, the recommended approach is to contact the Microsoft Data Protection team. You can reach them by calling Microsoft Customer Service using the phone numbers listed here: https://support.microsoft.com/en-us/topic/customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2

If you have access to another tenant or subscription where you still have Global Administrator privileges, you may also raise a support request from there to get assistance in restoring access to the affected tenant.

For future reference and to help prevent tenant lockouts, please check: https://learn.microsoft.com/en-us/partner-center/customers/gdap-preventing-tenant-lockouts

If neither option is possible, please don’t worry—let us know, we are happy to assist you further!
Syed Mohd Ali 0 Reputation points

2026-05-11T07:18:23.13+00:00

Hi @Shubham Sharma

I called the support, they asked me to create ticket on the azure site, however I am locked out of it so I cannot create the ticket. Can you support me here please?
Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator

2026-05-12T08:05:55.9566667+00:00

Syed Mohd Ali

To proceed, I will need a few details from you. As this information contains Personally Identifiable Information (PII), please share the following details in private message only:

Please send me the detail via private message. So, we can assist you further.

Answer 1

For a complete tenant lockout where the only Global Administrator is unable to complete MFA and no alternative methods are available, resolution requires direct engagement with Microsoft support and escalation to the Data Protection/Tenant Recovery team. This cannot be fixed from the portal or by self-service tools when there is no other Global Administrator.

Based on the documented patterns for similar cases:

If there is any other Global Administrator or privileged account in the tenant (even a guest GA in a related tenant), that admin can:
- Sign in to the Microsoft Entra admin center.
- Go to Identity > Users > All users.
- Select the locked-out Global Admin account.
- Open Authentication methods.
- Select Require re-register multifactor authentication.
- After this, the locked-out admin signs in again and is prompted to register MFA from scratch.
If there is truly no other Global Administrator with access (single-admin tenant lockout):
- This is treated as a tenant lockout scenario.
- The only supported path is to open a support case and have it escalated to the Data Protection (DP) / Tenant Recovery team.
- The DP team verifies tenant ownership and, once verified, can reset or re-register MFA for at least one admin account so that access to the tenant is restored.
How similar cases have been resolved:
- In comparable incidents where the only Global Admin lost access to Microsoft Authenticator and had no backup methods, support agents escalated the ticket to the Data Protection team, who then contacted the admin via phone or email, performed identity verification, and reset MFA or added an additional authentication method.
- In another case, support worked with the customer to create or use another Global Administrator account (for example, a guest GA in a related tenant), then used that account to perform Require re-register MFA on the locked-out user.
Next steps:
- Use any available Microsoft 365/Azure support channel (phone support is recommended in lockout scenarios) to open a support ticket for tenant lockout / MFA lockout.
- Clearly state that:
  - There is a complete tenant lockout.
  - There is only one Global Administrator.
  - MFA is enforced and the only registered method (Microsoft Authenticator) is inaccessible.
  - No alternative verification methods (SMS, email, other app) are configured.
- Request escalation to the Data Protection/Tenant Recovery team for MFA reset and tenant recovery.
- Be prepared to provide business and identity verification information as requested by the support engineer.

Once the Data Protection team completes verification, they can reset MFA or add another method so that the Global Administrator can sign in again and regain control of the tenant.

References: