Locked out of Entra ID B2C

Question

Locked out of Entra ID B2C

Paul Podgorsek 25

As an admin, I'm locked out of an Entra ID B2C instance. It asks for an MFA code but my phone is no longer logged in to that account and so I can't get a code. It doesn't provide an alternative. I don't have access to any secondary Global Admin account or emergency access account unfortunately.

I tried raising a support request on Azure but it just gives me generic information and won't let me create a ticket.

How can I regain access to that Entra ID B2C instance?

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-11T11:34:55.5233333+00:00

Hello Paul Podgorsek

Based on the details you’ve shared, this appears to be a tenant lockout scenario.

To resolve this, the recommended approach is to contact the Microsoft Data Protection team. You can reach them by calling Microsoft Customer Service using the phone numbers listed here: https://support.microsoft.com/en-us/topic/customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2

If you have access to another tenant or subscription where you still have Global Administrator privileges, you may also raise a support request from there to get assistance in restoring access to the affected tenant.

For future reference and to help prevent tenant lockouts, please check: Preventing tenant lockouts - Microsoft Learn.

If neither option is possible, please don’t worry—let us know, we are happy to assist you further!
Jalal Khan 30 Reputation points

2026-05-11T11:53:32.6+00:00
Hi Paul,

Adding to Rukmini's guidance — since you mentioned the Azure portal support flow isn't letting you raise a ticket, here are a few concrete paths that often work when you're fully locked out of an Entra ID B2C tenant:

Use a different Microsoft account to open the case. You don't need to be signed in to the locked tenant to file a support request. Sign in to https://admin.microsoft.com or the Azure portal with any other Microsoft work or personal account, then open a New Support Request and select the "I can't sign in to my account / Tenant administrator lockout" category. Reference the locked B2C tenant ID (the GUID from your original invite/welcome email or any app registration you have documented externally) in the case description.

Phone-based Microsoft support. For tenant lockout scenarios where self-service recovery is impossible, Microsoft has a dedicated process. Call the regional Microsoft business support number for your country (listed at https://support.microsoft.com/contactus) and ask specifically for the "Tenant administrator account recovery" team. They will verify domain ownership (usually via a DNS TXT record on your verified custom domain) and can reset MFA for one Global Admin.

Domain ownership proof — prepare this in advance. Microsoft will almost always ask you to add a TXT record to the verified custom domain attached to the B2C tenant. If the tenant only uses the default .onmicrosoft.com domain, recovery is significantly harder, so mention this up front.

Going forward, please configure at least two break-glass / emergency access accounts excluded from MFA Conditional Access policies and stored securely — this is the documented Microsoft recommendation precisely to avoid this scenario: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access

Hope this helps you get back in.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-12T11:26:32.9066667+00:00

Hello Paul Podgorsek

Following up to see if you were able to create the support ticket, otherwise please let us know, we are happy to assist you further!

Answer accepted by question author

Answer recommended by moderator

0 additional answers

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-11T11:34:55.5233333+00:00

Hello Paul Podgorsek

Based on the details you’ve shared, this appears to be a tenant lockout scenario.

To resolve this, the recommended approach is to contact the Microsoft Data Protection team. You can reach them by calling Microsoft Customer Service using the phone numbers listed here: https://support.microsoft.com/en-us/topic/customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2

If you have access to another tenant or subscription where you still have Global Administrator privileges, you may also raise a support request from there to get assistance in restoring access to the affected tenant.

For future reference and to help prevent tenant lockouts, please check: Preventing tenant lockouts - Microsoft Learn.

If neither option is possible, please don’t worry—let us know, we are happy to assist you further!
Jalal Khan 30 Reputation points

2026-05-11T11:53:32.6+00:00

Hi Paul,

Adding to Rukmini's guidance — since you mentioned the Azure portal support flow isn't letting you raise a ticket, here are a few concrete paths that often work when you're fully locked out of an Entra ID B2C tenant:

Use a different Microsoft account to open the case. You don't need to be signed in to the locked tenant to file a support request. Sign in to https://admin.microsoft.com or the Azure portal with any other Microsoft work or personal account, then open a New Support Request and select the "I can't sign in to my account / Tenant administrator lockout" category. Reference the locked B2C tenant ID (the GUID from your original invite/welcome email or any app registration you have documented externally) in the case description.

Phone-based Microsoft support. For tenant lockout scenarios where self-service recovery is impossible, Microsoft has a dedicated process. Call the regional Microsoft business support number for your country (listed at https://support.microsoft.com/contactus) and ask specifically for the "Tenant administrator account recovery" team. They will verify domain ownership (usually via a DNS TXT record on your verified custom domain) and can reset MFA for one Global Admin.

Domain ownership proof — prepare this in advance. Microsoft will almost always ask you to add a TXT record to the verified custom domain attached to the B2C tenant. If the tenant only uses the default .onmicrosoft.com domain, recovery is significantly harder, so mention this up front.

Going forward, please configure at least two break-glass / emergency access accounts excluded from MFA Conditional Access policies and stored securely — this is the documented Microsoft recommendation precisely to avoid this scenario: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access

Hope this helps you get back in.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-12T11:26:32.9066667+00:00

Hello Paul Podgorsek

Following up to see if you were able to create the support ticket, otherwise please let us know, we are happy to assist you further!

Answer 1

Because there is no access to the original MFA device, no backup authentication method, and no other Global Administrator or emergency access account, this is effectively a tenant lockout scenario.

The supported recovery paths in this situation are:

If there is any other Global Administrator (including in a related Microsoft 365/Azure tenant)
- That admin signs in to the Azure portal and opens Microsoft Entra ID for the affected tenant.
- Go to Users → select the locked-out admin account → Authentication methods.
- Use Require re-register multifactor authentication (or equivalent “reset MFA” option) so the account is forced to go through MFA registration again on next sign-in.
- Then sign in again and register a new MFA method (for example, Microsoft Authenticator on the new phone).
If there is absolutely no other Global Administrator / emergency access account
- This is a classic “only admin locked out” case. Microsoft’s Data Protection / Tenant Recovery team must be engaged to verify ownership and reset MFA or otherwise restore access.
- Forum moderators and normal support channels cannot directly change admin accounts; they can only route the case.
- The documented approach in similar cases is:
  - Call the regional Customer service phone numbers - Microsoft Support listed in the documentation.
  - When prompted by the automated system, clearly indicate that this is an Authenticator / MFA issue for an Office 365 or Azure for business / company account, that this is an administrator account, and that there are no other admins.
  - Ask for a service request and for the case to be escalated to the Data Protection team (or Tenant Recovery) for admin lockout.
  - Be prepared to provide tenant-identifying information and business documentation so ownership can be verified.
- If the subscription was purchased through a partner/reseller, contact that partner and ask them to open a Microsoft support ticket on behalf of the tenant for an admin lockout / MFA reset.
- As an alternative path if the portal won’t let a ticket be opened from the locked tenant, create a separate trial Microsoft 365/Azure tenant, sign in as its admin, go to the admin/support area, and open a support request from there explaining that the real issue is lockout from a different existing tenant where you are the only Global Admin. Provide the locked tenant’s domain and admin UPN so support can route it correctly.
Future prevention once access is restored
- Create at least two emergency access (“break glass”) accounts in Microsoft Entra ID, assign them Global Administrator, and exclude them from normal MFA policies as recommended. Use them only for true emergencies.
- Configure multiple MFA methods (for example, Microsoft Authenticator plus phone call or SMS, or passkeys/certificate-based authentication) for all admin accounts.
- Consider using passkey (FIDO2) or certificate-based authentication for admin sign-in, as these satisfy MFA requirements and reduce reliance on a single device.

In summary, with no other admin or emergency account available, only Microsoft Support (via the Data Protection/Tenant Recovery process, often initiated by phone or via a separate tenant) can restore access to the Entra ID B2C instance.

References:

Answer 2

Hello Rukmini and Jalal,

Thank you both for the information you provided. Sorry for replying so late, my case took ages to be processed - but it was successful. Thank you!

To anyone stumbling upon this post in the future, here are a few key points I'd like to highlight:

When calling the regional support number, an AI will answer. It took several calls before it directed me to the correct path. Ask specifically to speak with the "Tenant administrator account recovery" team instead of trying to explain what the issue is, as the AI couldn't understand it even when explaining in very simple words. (an Entra ID tenant lock-out recovery doesn't seem to be part of its options)
If you are resetting an admin account for a B2C instance, make sure you provide the tenant ID and tenant name ({name}.onmicrosoft.com) in an email when replying to requests from the recovery team. They seem to deal more often with requests for Entra ID for Workforce, and mentioning the specific tenant name on the phone did not prevent them from initially resetting my Entra ID for Workforce account. By default, they reset the tenant which my email address was attached to - which delayed the resolution by several days.

I hope that helps.

Jalal Khan 30 Reputation points

2026-06-20T07:16:49.0666667+00:00

Hi Paul — great to hear it was resolved successfully! Thanks for coming back to close the loop. Outcome confirmations like yours are genuinely valuable for anyone who hits the same Entra ID B2C lockout down the line. If any of the responses here helped, it would be great if you could mark it as Accepted so future readers can find the working path quickly. Glad it worked out for you!