A cloud-based identity and access management service for securing user authentication and resource access
Manual Global Admin account recovery and MFA reset can only be performed by Microsoft’s Data Protection / Tenant Recovery teams after identity verification. Forum moderators or documentation cannot directly reset MFA or bypass verification.
To proceed, follow these supported paths:
- Contact Microsoft 365 / Data Protection support by phone
- Use the regional phone numbers listed under Customer service phone numbers - Microsoft Support or Find Microsoft 365 for business support phone numbers by country or region.
- When connected to the IVR or agent, clearly state:
- This is a tenant lockout scenario.
- Security Defaults require MFA.
- Microsoft Authenticator is the only registered method and is no longer accessible.
- There is only one Global Administrator on the tenant and that admin is locked out.
- Request to be transferred/escalated to the Microsoft 365 Data Protection team (or Data Protection / Tenant Recovery team) for Global Admin account recovery and MFA reset.
- Be prepared to provide:
- Tenant information (for example,
princesuperstores.onmicrosoft.com). - Proof of domain/organization ownership and business documentation, as requested.
- Tenant information (for example,
- If a partner or reseller manages the tenant
- If a Microsoft partner created or manages the tenant, contact the partner and ask them to:
- Open a service request on behalf of the tenant, or
- Work with Microsoft support and the Data Protection team to restore access.
- Partners with an active GDAP relationship and appropriate roles can often help without Microsoft involvement, but in a single-admin lockout scenario, Microsoft must work directly with the tenant’s Global Admin/owner.
- If a Microsoft partner created or manages the tenant, contact the partner and ask them to:
- If no other admin exists and no GDAP partner is available
- This matches the documented tenant lockout scenario where the only Global Administrator has lost access and cannot use SSPR or MFA.
- In such cases, the guidance is:
- Attempt recovery via the Self Service Password Reset tool if any method is still usable.
- If SSPR and Admin Account Recovery both fail, the tenant owner / Global Administrator must contact Microsoft support and work with the Data Protection team for manual recovery.
- What Microsoft for Nonprofits and forums cannot do
- They cannot:
- Provide access to an existing tenant without identity verification.
- Change tenant ownership.
- Recover usernames or passwords directly.
- All tenant ownership and access decisions are handled only through Microsoft 365 support and Data Protection.
- They cannot:
In summary, the only supported way to get a manual Global Admin account recovery and MFA reset in this scenario is to contact Microsoft 365 support by phone, request escalation to the Microsoft 365 Data Protection / Tenant Recovery team, and complete their identity and tenant ownership verification process.
References:
- Tenant access recovery
- Troubleshoot sign-in issues and account access problems
- Account recovery overview
- Preventing tenant lockouts
- Tenant Lockout: Scenarios & Next Steps
- Common problems with two-step verification for a work or school account
- Global Admin Locked out - Microsoft Q&A
- Requesting a Tenant Admin MFA Reset - Microsoft Q&A
- Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
- I need to reset my mfa methods - Microsoft Q&A
- Microsoft authenticator sending me into a spiral - Microsoft Q&A