Sole Global Admin locked out by MFA - lost Authenticator device - tenant recovery needed

Danny Koťan 25 Reputation points
2026-08-21T18:03:11.25+00:00

Product tag: Microsoft Entra ID (secondary: Microsoft 365)

Title:

Sole Global Admin locked out by MFA - lost Authenticator device - tenant recovery needed

Body:

I am the sole Global Administrator of Microsoft Entra tenant e582e339-62cf-4d1a-9430-cd3afd85f29c (default domain kestrelaircraftinteriors.onmicrosoft.com, region EU, Managed namespace).

I am locked out of the admin account. I know the password. The only registered authentication method is Microsoft Authenticator, enrolled on a phone I no longer have (IP 13 Pro Max). Confirmed via sign-in behaviour: no alternate MFA method offered, no FIDO key, no passkey registered (New phone: Samsung S24 U). There is no second Global Administrator. The tenant is not federated, so there is no on-premises route.

The Microsoft 365 Business Standard subscription expired on 29 July 2026, so the tenant is progressing toward deprovisioning and the data in it is at risk.

Context on the account: at the time the tenant was created, work accounts had not yet been rolled out to all staff, so this single licensed account was in day-to-day use by the owner of the company. He signed in to Windows on his work laptop with it and used it for Outlook, Word, PowerPoint and other Microsoft provided apps. It is therefore the company's primary Microsoft identity and holds business-critical material. The company owner is available to verify ownership directly and to sign any request required.

I cannot open a support ticket from my own admin center because that requires the sign-in that is blocked, and I am not in a position to create a paid trial tenant purely to raise a case.

I am requesting escalation to the Data Protection / Identity team for an authentication-method reset or a Temporary Access Pass.

I can provide full ownership evidence privately, including:

  • the mobile number registered against the account
  • the alternate/personal email address on file for this tenant, which receives its billing and subscription notifications - I received the renewal notice dated 29 June 2026 at that address and can forward it in full with headers
  • Microsoft invoices and order numbers for the subscription
  • the payment method on file and the billing address
  • company registration documents (Czech Republic)
  • a signed request on company letterhead
  • proof of control of the company domain kestrel-interiors.com via DNS record, if useful as supporting evidence

Please advise how to proceed and where to send this evidence securely.

Microsoft Security | Microsoft Entra | Microsoft Entra ID
Answer accepted by question author
Bence Weiszmann 1,395 Reputation points
2026-08-21T18:07:21.58+00:00

Dear @Danny Koťan

If there is no other Global Administrator available in the tenant, this needs to go through Microsoft's tenant recovery process.

I would recommend contacting Microsoft Support and explicitly describing this as a tenant lockout / no accessible Global Administrator case.

You can start here:

Microsoft Entra – Get support

If you prefer to call Microsoft Support, the exact phone menu depends on your country or region. In some countries, there is an initial message telling you to visit the online support page. You can simply wait for the menu options.

In other countries, the call may be handled by an automated conversation. For example:

  1. What kind of problem are you concerned about?
    1. Authenticator
  2. What kind of product are you using?
    1. Office 365 for business/Azure portal/Entra ID
  3. Is this an education or company account?
    1. Company
  4. Are you an administrator?
    1. Yes
  5. Do you have another administrator in your organization?
    1. No
  6. You need to create a service request.
    1. Yes

The exact wording may differ depending on the country and the current phone system, but the important part is to get the call converted into a support/service request.

Once you reach a support engineer, I would be very explicit:

“This is a Microsoft Entra tenant lockout. The only Global Administrator account is no longer accessible, and there are no other Global Administrators in the tenant. We need to recover administrative access to the tenant. Please escalate this case to the Data Protection / Tenant Recovery team.”

Have the following information ready for the ownership verification:

  • Tenant ID
  • Initial *.onmicrosoft.com domain
  • Custom domain name(s)
  • Proof of domain ownership / DNS access
  • Microsoft 365 subscription and billing information
  • Company information
  • Details about the previous Global Administrator
  • Any other information Microsoft requests to verify ownership

For future protection, I would also recommend having at least two independently managed Global Administrator accounts and dedicated emergency access accounts. This prevents losing access to the entire tenant when a single administrator account becomes unavailable.

If this answers your query, please click Accept Answer and Upvote if you found it helpful. If you have any further questions, feel free to let us know.

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.