Microsoft Entra ID

Kyle Whitfield 0 Reputation points
2026-05-28T11:27:09.06+00:00

I am the sole Global Administrator of a Microsoft 365 business tenant and I am completely locked out. When I sign in, my username and password are accepted, but the MFA step fails.

The only registered MFA method on this account is my mobile phone (SMS/voice). I have never set up the Microsoft Authenticator app, so there is no alternative method available. When I click "Send SMS" or "Call me," nothing arrives and the sign-in fails with the following error:

Error Code: 399287 Request Id: 0fb39fc0-75ce-47d7-aa05-049f82255200 Correlation Id: 0602cfe9-49f6-4558-b51c-958ffaddc7b0 Timestamp: 2026-05-28T11:21:16Z

I understand error 399287 means my phone number has been blocked by the Phone Reputation service and that this can only be cleared from Microsoft's backend, not from my side. My phone number is correct and active.

Because I am the only admin and have no other MFA method, I cannot reset this myself or have another admin do it. Please could a moderator help clear the telephony/phone-reputation block and reset MFA on my account so I can sign in and register a stronger method (Authenticator). I'm happy to provide my tenant ID, admin sign-in name, phone number and country privately for verification

Microsoft Security | Microsoft Entra | Microsoft Entra ID

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-05-28T11:27:53.3033333+00:00

    Error 399287 and the described behavior indicate that the SMS/voice method for that phone number is blocked by Microsoft’s phone reputation/telephony systems and cannot be cleared by tenant configuration. Because the account is the only Global Administrator and there is no working alternative MFA method, recovery must be handled by Microsoft support (Data Protection / Tenant Recovery), not by a forum moderator or self-service.

    Follow these steps to regain access:

    1. Contact Microsoft Data Protection / Tenant Recovery by phone
      Use the global customer service phone numbers listed in Customer service phone numbers - Microsoft Support. When the IVR (automated system) asks questions, answer along these lines to reach the correct team:
      • Problem type: say “Authenticator” or “sign-in / verification code”.
      • Product: “Office 365 for business” or “Microsoft 365 for business”.
      • Account type: “Company account” (not personal/consumer).
      • Are you an administrator?: “Yes”.
      • Are there any other administrators?: “No”.
      • When asked if a service request is needed: “Yes, I need to create a ticket and speak with the Data Protection team about an admin lockout and MFA reset.”
      Clearly state:
      • You are the sole Global Administrator for the tenant.
      • You are locked out at the MFA step because SMS/voice is blocked (error 399287) and there is no other MFA method.
      • You need Data Protection / Tenant Recovery to:
        • Clear the telephony/phone-reputation block for the admin phone number, and/or
        • Reset the MFA registration for the admin account so a new method (such as Microsoft Authenticator) can be configured.
      Be prepared to provide, when requested by support (not in public forums):
      • Tenant name and domain (for example, contoso.onmicrosoft.com).
      • Admin UPN (sign-in name).
      • Phone number and country/region used for MFA.
      • Business verification information and any documentation they ask for.
    2. If phone support is hard to reach, create a temporary trial tenant to open a ticket
      If direct phone contact with a live agent fails, create a new Microsoft 365 trial tenant and use its admin center to open a support ticket:
      1. Sign up for a Microsoft 365 Business/Enterprise trial to create a new tenant (this is separate from the locked tenant).
      2. In the new tenant, go to the Microsoft 365 Admin Center (https://admin.microsoft.com).
      3. Navigate to Support → Help & support.
      4. Open a ticket explaining that:
        • The issue concerns a different, existing tenant where you are the sole Global Administrator.
        • You are locked out due to MFA (SMS/voice) failing with error 399287 and cannot access the admin portal.
        • You need to be connected to the Data Protection team to verify identity, clear the phone reputation block, and reset MFA for the admin account on the original tenant.
      5. Provide the locked tenant’s details (admin UPN, tenant domain, error code, timestamp, phone number, etc.) in the ticket as requested.
      6. After the issue is resolved and access to the original tenant is restored, cancel the trial for the temporary tenant to avoid charges.
    3. After access is restored
      Once Data Protection / Tenant Recovery has cleared the block and/or reset MFA so sign-in is possible again:
      1. Sign in as the Global Administrator.
      2. Immediately register additional, stronger MFA methods, especially:
        • Microsoft Authenticator app (push notifications or OTP).
        • At least one backup method (another phone, alternate number, or passwordless method).
      3. Consider moving to modern, phishing-resistant methods such as:
        • Passkeys (FIDO2 security keys).
        • Windows Hello for Business.
        • Certificate-based authentication.
      Having multiple methods and more resilient authentication (for example, Authenticator plus a FIDO2 key) reduces the risk of being locked out again if SMS/voice is blocked or a device is lost.

    Because error 399287 and telephony reputation blocks are enforced in Microsoft’s backend and there is no other admin available, only Microsoft’s support/Data Protection team can clear the block and reset MFA for this scenario.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.