Global Admin locked out of Microsoft 365 tenant due to MFA loop — Data Protection escalation needed

KROLL Olivia 0 Reputation points
2026-06-08T13:50:30.11+00:00

I am the sole Global Administrator of a Microsoft 365 Business Basic tenant. I am completely locked out due to an MFA loop — the only verification method registered on my account is Microsoft Authenticator, which I cannot access.

I do have backup recovery methods configured (backup email linked to my university account), however these only allow me to reset my password — they do not bypass the MFA requirement on login. After resetting my password I am still prompted for Authenticator verification and cannot proceed.

I cannot access the admin portal, cannot generate a service key, and phone support lines are routing me to consumer support rather than business admin recovery.

I need this escalated to the Microsoft 365 Data Protection / Tenant Recovery team to reset MFA on my admin account so I can re-register authentication methods.

I am able to verify tenant ownership and identity through billing records and domain ownership. I can provide Tenant ID and domain details directly to a Microsoft staff member via private message or official support channel — I will not post these publicly.

Please advise on the correct escalation path or open a Data Protection ticket on my behalf.

Community Center | Not monitored

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-06-08T13:51:03.7333333+00:00

    Because the account is the only Global Administrator and is locked out by MFA with no other admin available to reset authentication methods, the issue must be handled by Microsoft’s Data Protection/Tenant Recovery team. Forum moderators and standard support channels can’t directly change admin MFA or tenant access.

    Use the following escalation path:

    1. Contact Microsoft Data Protection by phone
      1. Call Microsoft customer service using the regional business support numbers listed at Customer service phone numbers - Microsoft Support.
      2. When interacting with the IVR/agent, clearly state:
        • The subscription is Microsoft 365 for business.
        • It is a company/education account, not a personal account.
        • The caller is the only Global Administrator and is locked out due to Microsoft Authenticator MFA.
        • A Data Protection / Tenant Recovery case is needed to reset MFA on the admin account.
      3. If asked whether there is another administrator, explicitly answer No so the call can be routed correctly.
    2. If the tenant is managed by a partner (CSP)
      • If the subscription was obtained through a Cloud Solution Provider, contact the partner and ask them to open a support request on behalf of the tenant using their GDAP permissions, as described in the GDAP and CSP guidance.
    3. If phone routing continues to fail
      • As an alternative, create a temporary trial tenant (separate from the locked tenant), sign in to its Microsoft 365 admin center, and open a support ticket from there.
      • In the ticket, specify that the request is for Data Protection/Tenant Recovery for a different, existing tenant where the caller is the sole Global Admin locked out by MFA.
      • Provide tenant ID, domain, and billing/ownership evidence directly to Microsoft support through that secure channel.

    Microsoft’s Data Protection team has specific processes to verify identity and ownership (for example, via billing records and domain control) and then reset MFA/restore access when there is only one Global Administrator and no internal recovery path.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.