Global admin locked out MFA no access to authenticator

Question

Global admin locked out MFA no access to authenticator

Liene 0

I am the only Global Admin of a Microsoft 365 tenant. After a device reinstall, Microsoft Authenticator stopped working. I can still sign in with: - PII But the actual Global Admin account: - PII requires MFA code from Authenticator. I no longer have access to the MFA codes. There are no other Global Admins in the tenant. I need Microsoft to reset MFA for the Global Admin account. Domain: PII

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-22T11:19:16.24+00:00

Hello Liene

Based on the details you’ve shared, this appears to be a tenant lockout scenario.

To resolve this, the recommended approach is to contact the Microsoft Data Protection team. You can reach them by calling Microsoft Customer Service using the phone numbers listed here: Customer service phone numbers - Microsoft Support.

If you have access to another tenant or subscription where you still have Global Administrator privileges, you may also raise a support request from there to get assistance in restoring access to the affected tenant.

For future reference and to help prevent tenant lockouts, please check: Preventing tenant lockouts - Microsoft Learn.

If neither option is possible, please don’t worry—let us know, we are happy to assist you further!
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-25T10:00:20.05+00:00

Hello Liene

Following up to see if you were able to create the support ticket, otherwise please let us know, we are happy to assist you further!
Liene 0 Reputation points

2026-05-25T10:13:52.0766667+00:00

Thank You! I have created ticket.

1 answer

Your answer

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-22T11:19:16.24+00:00

Hello Liene

Based on the details you’ve shared, this appears to be a tenant lockout scenario.

To resolve this, the recommended approach is to contact the Microsoft Data Protection team. You can reach them by calling Microsoft Customer Service using the phone numbers listed here: Customer service phone numbers - Microsoft Support.

If you have access to another tenant or subscription where you still have Global Administrator privileges, you may also raise a support request from there to get assistance in restoring access to the affected tenant.

For future reference and to help prevent tenant lockouts, please check: Preventing tenant lockouts - Microsoft Learn.

If neither option is possible, please don’t worry—let us know, we are happy to assist you further!
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-25T10:00:20.05+00:00

Hello Liene

Following up to see if you were able to create the support ticket, otherwise please let us know, we are happy to assist you further!
Liene 0 Reputation points

2026-05-25T10:13:52.0766667+00:00

Thank You! I have created ticket.

Answer 1

Because the only Global Administrator is locked out and there are no other admins who can reset MFA, this is a tenant lockout scenario that must be handled by Microsoft Support/Data Protection.

Follow these steps to regain access:

Contact Microsoft Support by phone
- Call the appropriate number listed under Customer service phone numbers - Microsoft Support.
- When prompted by the IVR, clearly indicate:
  - The product is Office 365/Microsoft 365 for business.
  - The issue is with Microsoft Authenticator / MFA.
  - The account is a company/organization account.
  - Confirm being an administrator and that there is no other global admin in the tenant.
  - Request to create a service request and be routed to the Data Protection / Tenant Recovery team to reset MFA for the global admin account.
Be prepared to verify tenant ownership
- Support will require proof that control of the tenant and domain (luckypunch.lv) is held. Have business documentation and account details ready as requested by the support engineer.
Work with the Data Protection team
- After the ticket is created and escalated, the Data Protection team will contact via phone or email.
- They will perform verification and, once satisfied, reset or clear the MFA registration for the global admin account so that a new MFA method (such as Microsoft Authenticator) can be configured at next sign-in.

If initial contact attempts do not reach the correct team, explicitly ask the agent to open a ticket for tenant admin MFA reset / tenant lockout and escalate to the Data Protection team.

Forum moderators and tools cannot perform this reset; only Microsoft Support/Data Protection can assist in this scenario.

References: