Global Admin locked out - lost MFA access, no other admin in tenant

Question

Global Admin locked out - lost MFA access, no other admin in tenant

CrisConnect - JFQuintaGrande 20

My organization is a small local government body [Moderator note: personal info removed] in Portugal, running Microsoft 365 Business. I manage IT for them as an external contractor.

Situation:

I identified the tenant's only Global Administrator account: [Moderator note: personal info removed].onmicrosoft.com
I do not have the password for this account
The account's MFA method is Microsoft Authenticator, and I do not have an active session on that Authenticator app
There is no other Global Administrator or Privileged Role Administrator account in this tenant
I confirmed via the "Global Administrator | Assignments" blade in Microsoft Entra ID that this is indeed the only account with the Global Admin role

What I've already tried:

passwordreset.microsoftonline.com: I have access to the alternate recovery email and successfully verified via that method, but the process then requires a SECOND verification method (phone call to an office number I don't have access to, or Authenticator approval), which I cannot complete. So the password reset process cannot be finished.
Called Microsoft support (Portugal, 800 20 91 75) - the call disconnected before I could be transferred to a relevant team
Tried the Azure Support request form under "Administrator Global | Assignments" - it only offers Billing/Subscription management categories, not identity/MFA recovery
Used Copilot in the Azure portal, which correctly identified this as a "Microsoft Entra Sign-in and Multifactor Authentication" issue and pointed me to documentation about "Require re-register multifactor authentication" - but this action requires another admin with sufficient rights, which I don't have

Question:

Given this is a sole Global Admin tenant lockout with a partially-verified identity (I do have access to the recovery email), what is the correct way to get this escalated to Microsoft's Data Protection / Tenant Recovery team? Is there a specific phone script, ticket category, or direct escalation path that avoids the disconnection issue I experienced, given that I cannot open a support ticket from within the tenant itself?

Any guidance on the exact steps or wording to use with phone support would be greatly appreciated.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

As your issue description is primarily written in English, I will provide my response in English for your convenience. Please feel free to let me know if you would prefer the information in another language.

Hi Cris,

From what you've shared, this issue is indeed treated as a tenant ownership or administrator access recovery scenario. In such cases, there is no self-service method to regain control, and the correct path is to request assistance from Microsoft.

Just to briefly clarify before we go any further, independent consultants, including myself, are members of the community and do not have access to user account settings, and cannot assist with logging in, resetting passwords, changing access rights or directly escalate cases to the Data Protection team. For security and privacy reasons, connecting to the team requires opening a support request.

Since you've already tried contacting Microsoft Support by phone without success, a possible workaround is to create a separate Microsoft 365 trial tenant and use it solely to submit a support request.

Here's how you can do it:

1/ Go to Microsoft 365 Business Plans & Pricing | Microsoft 365 (select "Try for free" in an enterprise subscription).

2/ Follow the instructions provided to create a trial tenant.

3/ Once the new tenant is created, go to the Microsoft 365 Admin Center > Help and Support to submit a support ticket, requesting to speak with the Data Protection Team on behalf of your original tenant.

4/ In the ticket description, you'll need to clearly explain that you're trying to regain access to your previous Microsoft 365 tenant as a single admin and that you need help from the Data Protection team.

Here's a message you can use or adapt:

"Hi, I can't currently access my previous Microsoft 365 tenant as the only global admin."

I created this new tenant only to request assistance. I kindly ask you to connect me to the Data Protection team to verify my identity and help me regain access to the original tenant.

This is urgent as I rely on Microsoft 365 for my work and have been unable to operate for several days. I am available to provide any documentation or verification necessary to support the recovery process."

Important Notes:

This new trial tenant will not give you access to any data or settings from your original locked-down tenant. It only serves as a temporary means of contacting Microsoft support.
Remember to cancel the trial subscription of the new tenant once the issue with the original account is resolved, to avoid unwanted charges. Cancel your Microsoft business subscription in the Microsoft 365 admin center | Microsoft Learn.

If you'd still like a script to help navigate the IVR more efficiently, here are some tips along with a sample prompt you can use:

IVR: What problem is bothering you?

Client: Lost access to the only admin account

IVR: What product do you use?

Customer: Office 365 for business

IVR: School or Business Account?

Client: Companies

IVR: Are you an administrator?

Client: Yes

IVR: Is there another administrator in your organization?

Client: No. I am the only admin in my tenant

IVR: Do you need to create a support ticket?

Client: Yes. I need to create a ticket. Please send me direct to the Data Protection Teams.

When contacting Microsoft, be prepared to verify ownership of the subscription. You may be asked for information such as:

Organization name
Billing or payment information
Registered phone number
Alternate email address

You may also consider try calling another support number to see if it helps reaching the support team faster this time: Contact Microsoft customer support.
User's image

I hope the information provided will help guide you in the right direction. While I can't take direct action, I sincerely hope that the steps and recommendations I've shared can assist you through the process.

If the answer was helpful, click "Yes." If you have any questions about this answer, click on "Comment".

Note: Follow the instructions in the forum documentation to enable email notifications if you wish to receive notifications on this topic.

CrisConnect - JFQuintaGrande 20 Reputation points

2026-08-07T21:34:47.3933333+00:00

Hi,

Thank you so much for this detailed and practical guidance, this is exactly the kind of help I needed. I really appreciate you taking the time to explain both the trial tenant workaround and the IVR script in such detail.

I'm following your steps now: creating a temporary trial tenant to open a support request and get connected with the Data Protection team. I'll make sure to cancel the trial subscription once the original tenant access is restored, as you noted.

This has been an incredibly helpful response, thank you again for the clear, actionable advice. I'll mark this as the accepted answer.

Best regards, Cristiano
Lin v 1,295 Reputation points Independent Advisor

2026-08-07T21:40:28.9333333+00:00

Hi Cristiano,

Thank you for your very kind words and for accepting the answer.

If you have any concerns or questions in the future, please don’t hesitate to reach out. Not only will I be happy to assist you, but other members in the Q&A forum will also do their best to provide support and guidance.

Wishing you a smooth rest of your day.