Locked out as the only Global Administrator

Question

Locked out as the only Global Administrator

clak 20

I am the only Global Administrator of my Microsoft 365 tenant.

Error Code: 500121

Microsoft Authenticator registration became corrupted after changing the username and resetting MFA.

Actions already performed:

Authenticator account removed
MFA re-registration enforced
Sessions revoked
Authentication methods removed

Result:

Outlook mailbox still works
Microsoft 365 Admin Center inaccessible
Entra Admin Center inaccessible
Security info page still requires Microsoft Authenticator approval although no valid Authenticator registration exists.

How can I completely reset MFA registration for this Global Administrator account?I am the only Global Administrator of my Microsoft 365 tenant.

0 comments

Answer accepted by question author

Michelle-N 20,735 Microsoft External Staff Moderator

I would like to first clarify that this is a user-to-user support forum, and we are not Microsoft support. Moderators here do not have backend access and cannot directly intervene in Microsoft products or perform escalations. We can only provide technical guidance and best-practice recommendations based on reported issues.

Hi @clak

Because this involves a specific business tenant and strict account security, this circular authentication loop cannot be resolved publicly in this forum, as we do not have access to your organization's backend settings.

In this situation, there are two official paths you can take to regain access to the tenant:

1.Please visit the following page and reach out to phone number via: Customer service phone numbers - Microsoft Support

From what I know, you will need to get past the initial AI system to reach the live support team. You can refer to the guide below for tips on how to get through more easily:

User's image

2.If method 1 is not working, please follow this link to create a trial tenant: https://www.microsoft.com/en-us/microsoft-365/business/microsoft-365-business-basic?msockid=3eb6980b5c6860e63a588d0c5d1761d6 - after that you will be able to access to Microsoft 365 Admin Center to raise the ticket

Assuming that you have already created an account after registering a free trial and you can go to Microsoft 365 admin center and click "Help & support" icon to raise your ticket. The agent will be able to create a ticket for you under the affected tenant and then transfer this ticket to Data Protection team who could help you to regain access. User's image

Please mention that you are raising ticket on behalf of the affected tenant that you do not have access to. The support team will help you to create ticket on the affected tenant then later on the Microsoft Data Protection team will assist you.

Note: This process will take more time than usual (7-14 working days) for your account to get access again as Data Protection is always overwhelmed with the number of tickets. As I am forum moderator, I do not have access to Microsoft internal system to assist or push this process to be quicker.

On the other hand, if you do create the trial and it resolves the issue, please remember to cancel the subscription afterward to avoid any related charges.

I hope my information is helpful. Please give me any updates once you get this resolved.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

0 comments

1 additional answer

Your answer

Answer 1

Because this is a tenant lockout scenario where the only Global Administrator cannot complete MFA and no other admin can reset it, the MFA registration for this account cannot be fully reset by self-service or portal actions alone. Recovery must go through Microsoft support and the Data Protection/Tenant Recovery process.

Use the following approach:

Confirm there is no other Global Administrator
- If there is any other Global Administrator or a partner with appropriate GDAP roles (for example, Privileged Authentication Administrator), that account can:
  - Sign in to the Microsoft Entra admin center.
  - Go to Users → select the locked-out admin account → Authentication methods.
  - Select Require re-register multifactor authentication.
- This forces a fresh MFA registration at next sign-in and is the standard fix when another admin exists.
If truly the only Global Administrator (tenant lockout)
- This matches the documented tenant lockout scenarios where all Global Administrators lose access due to MFA failures.
- In this case, the only supported path is escalation to Microsoft’s Data Protection/Tenant Recovery team via a support request. Forum moderators or normal support channels cannot directly change MFA for the account.
Contact Microsoft Data Protection support by phone
- Call the appropriate Customer service phone number for the region (see “Customer service phone numbers - Microsoft Support” in the referenced articles).
- When interacting with the IVR/agent, clearly state:
  - The issue is with Microsoft Authenticator / MFA.
  - The product is Office 365 / Microsoft 365 for business.
  - The account is a company (work) account.
  - The caller is the only Global Administrator on the tenant.
  - A service request is needed and must be routed to the Data Protection team for tenant recovery / admin MFA reset.
- The Data Protection team will verify identity and ownership and then reset the authentication methods/MFA registration for the Global Administrator so that a new MFA setup can be completed.
Alternative path if phone support is hard to reach
- If unable to reach a live agent or create a ticket from the locked tenant, create a temporary trial Microsoft 365 tenant:
  - Sign up for a trial subscription to create a new tenant.
  - In that new tenant, go to the Microsoft 365 admin center and open a support request.
  - In the ticket, explicitly state that the request is on behalf of a different, existing tenant where the only Global Administrator is locked out due to MFA (Authenticator) issues and needs Data Protection assistance.
- This does not give access to the original tenant directly; it is only a channel to reach support and the Data Protection team.
If the subscription is through a partner
- If the Microsoft 365 subscription is managed by a partner/reseller and no Global Administrator can open a service request, the partner should:
  - Use their Partner Center access and GDAP relationship (if present) to open a support request on behalf of the tenant.
  - Work with Microsoft support/Data Protection to restore Global Administrator access.
After recovery
- Once Data Protection has reset MFA and access is restored:
  - Add at least one more Global Administrator account.
  - Configure emergency access (“break-glass”) accounts that are excluded from MFA/Conditional Access and have long, complex passwords.
  - Add multiple MFA methods (Authenticator, phone, etc.) for each admin to avoid single-point-of-failure on Authenticator.

In this scenario, a complete reset of MFA registration for the only Global Administrator can only be performed by Microsoft’s Data Protection/Tenant Recovery team after identity verification via a support case.

References: