Locked out of Microsoft 365 tenant. Sole global admin lost MFA access.

Question

Locked out of Microsoft 365 tenant. Sole global admin lost MFA access.

Chris Ho` 20

I know my 365 login details ie email, password and have MFA access but I am not admin.

My other issue is I need to log into the admin so I can change payment details as my current payment method cannot be used anymore as the card is cancelled.

0 comments

Answer accepted by question author

Tamara-Hu 17,960 Microsoft External Staff Moderator

Hello @Chris Ho`,

I'm sorry to hear that you're locked out of Microsoft 365 tenant.

Based on your description, you'll need to revoke your MFA access for the admin account, which will allow you to set up Authenticator on a new device and then you can access Microsoft 365 Admin center to change your payment details.

As you are the only administrator in this tenant, you will need to contact the Microsoft Data Protection team, as they are the only group authorized and equipped with the necessary tools and verification procedures to confirm your identity and restore administrator access.

Please try to find the related hotline number to call the frontline and let them raise a ticket for you (expand region under Business Users): Customer service phone numbers - Microsoft Support

Carefully follow this instruction to ask for Microsoft Data Protection team support:

Depending on your country or region.

For some countries, when calling the support number, although there are about 30 seconds opening as something "you can visit the link...." But you can ignore this opening and wait until the option, then "1" as a business email user, "1" again for technical help.

For some countries, it will be an automated conversation like:

First, when you call the hotline, it asks what kind of problem you are worried about.
Answered: authenticator.
A: What kind of product are you using?
B: Microsoft 365 for business.
A confirmation: education or company account?
B: For companies
A: Are you an administrator?
B: Yes.
A: Do you have the other admin in your organization?
B: No.
A: You need one.... Service request?
B: Yes

If your subscription is from a partner or reseller, contact the reseller's support provider to help open a service request on behalf of you instead.

I’d like to clarify that as a forum moderator, I do not have access to user sign-in logs, cannot reset MFA, revoke access, or contact Microsoft Support on your behalf. Please consider me an end user as well, providing guidance based on experience and documented processes.

If you encounter any difficulties in contacting the frontline support, please feel free to let me know. Thank you and I wish you a great day!

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Chris Ho` 20 Reputation points

2026-06-02T23:18:23.79+00:00

I have tried to call the support however it keeps dropping out or not able to capture my alternative email email address as the ai assistant keeps putting a dot in the alternative email address. Is there a way to raise a support case online rather than by phone?
Chris Ho` 20 Reputation points

2026-06-03T01:12:24.4133333+00:00

yes eventually after 20 or so attempts didnt get disconnected and was able to connect to the admin centre.
Tamara-Hu 17,960 Reputation points Microsoft External Staff Moderator

2026-06-03T08:31:37.5433333+00:00
Hello @Chris Ho`,

I'm sorry to hear about your frustrating experience.

If you still have trouble using the frontline support, you can try set up a new trial tenant and submit your support request:

Visit the Microsoft 365 Enterprise Plans page: Go to Compare Office 365 Enterprise Pricing and Plans | Microsoft 365.

Choose a plan and start a free trial: Select any of the available plans and click "Try for free" to begin the trial setup process.

Follow the guided setup: Complete the steps to create a new Microsoft account and a new tenant. This will be a separate and independent Microsoft 365 environment.

Access the Microsoft 365 Admin Center: Once the new tenant is created, navigate to https://admin.microsoft.com/.

Go to Support:

Click on "Help & Support" button like this image.

Toggle Support Assistant option to OFF > Type your issue under "How can we help?" Box > click Get Help.

The Contact Support button will become available, you can click on it now.

Choose contact method: "Phone" or "Email"

Raise a support ticket: Describe your issue in detail. Crucially, you must clearly state that you are locked out of a different, pre-existing Microsoft 365 tenant where you are the administrator. Provide the following information about your locked account:

The domain name of your locked tenant

Your administrator account.

Any error messages you are receiving.

Details about the authentication issues you are experiencing.

Your proof of ownership.

Finally, clicking on "Contact me".

Important notes:

This new trial tenant will not give you access to any of the data or settings in your original locked tenant. It is solely a temporary means to contact Microsoft support.

Be prepared for Microsoft support to ask for verification of your identity and administrative rights for the locked tenant.

The resolution time might be longer as you are contacting support from a different tenant.

Remember to cancel the trial subscription for the new tenant once your issue with the original account is resolved to avoid any unintended charges. You can typically do this within the Microsoft 365 Admin Center under "Billing" -> "Your products."

If you still have any issue, please don't hesitate to reply. Thank you for your patience and understanding so far!

1 additional answer

Your answer

Chris Ho` 20 Reputation points

2026-06-02T23:18:23.79+00:00

I have tried to call the support however it keeps dropping out or not able to capture my alternative email email address as the ai assistant keeps putting a dot in the alternative email address. Is there a way to raise a support case online rather than by phone?
Chris Ho` 20 Reputation points

2026-06-03T01:12:24.4133333+00:00

yes eventually after 20 or so attempts didnt get disconnected and was able to connect to the admin centre.

Answer 1

Because the account with global admin rights is locked behind MFA and there is no other global admin, the tenant is effectively in a tenant lockout state. A non-admin user cannot promote themselves to admin or change billing/payment details.

Use the supported recovery paths:

Confirm there is truly no other admin
- Follow the guidance to identify the administrator for the work or school account (for example, internal IT/help desk, business owner, or partner). If another global admin exists, that admin can:
  - Reset the locked admin’s password or MFA.
  - Or update the payment method directly in the Microsoft 365 admin center.
If there is no other global admin
- This scenario must be handled by Microsoft’s Data Protection / Tenant Recovery teams. Forum moderators and non-admin users cannot bypass this.
- From the context:
  - If the company has no global admin, a user who is part of the tenant must contact Microsoft 365 support and ask to be transferred to the Microsoft 365 Data Protection team to have a password/MFA reset and restore global admin access.
  - Use the regional support numbers listed under “Get support - Microsoft 365 admin” or “Customer service phone numbers - Microsoft Support” and clearly state:
    - This is a business/organization (work or school) account.
    - The sole global admin is locked out due to MFA.
    - A payment method must be updated but admin access is unavailable.
- The Data Protection team will verify identity and tenant ownership using business documentation and then can:
  - Reset the global admin’s password or MFA methods.
  - Or assign global admin rights to a verified user in the tenant.
If a partner or reseller manages the tenant
- If the subscription was set up by a Microsoft partner (CSP/IT provider), contact that partner:
  - They can use their delegated admin privileges (GDAP) to reset the admin password/MFA or promote a user to global admin, if they hold the appropriate roles.
After access is restored
- Sign in to the Microsoft 365 admin center as global admin and update the payment method.
- To avoid future lockouts:
  - Ensure there is more than one global admin or at least a Privileged Authentication Administrator.
  - Configure multiple MFA methods (e.g., Authenticator plus phone/SMS) for all admin accounts.

References: