Sole Global Admin locked out of Entra ID tenant — Authenticator MFA loop / tenant lockout

Maria Hernandez 20 Reputation points
2026-08-27T15:13:42.9466667+00:00

Sole Global Administrator locked out by MFA — Tenant Recovery needed I am the sole Global Administrator of my Microsoft 365 business tenant. I lost the phone containing Microsoft Authenticator. The only available MFA methods require the lost Authenticator registration. There is no second Global Administrator and no alternate MFA method.

Billing profile: Avva Films Subscription: Microsoft 365 Copilot

I can provide billing and ownership verification privately. I need this escalated to the Microsoft Data Protection / Tenant Recovery team to reset the MFA registration for the sole Global Administrator.

Microsoft 365 and Office | Subscription, account, billing | For business | Other
0 comments
Answer accepted by question author
Bence Weiszmann 1,560 Reputation points
2026-08-27T17:48:37.2833333+00:00

Dear @Maria Hernandez

If this answers your query, please click Accept Answer and Upvote if you found it helpful. If you have any further questions, feel free to let us know.If there is no other Global Administrator available in the tenant, this needs to go through Microsoft's tenant recovery process.

I would recommend contacting Microsoft Support and explicitly describing this as a tenant lockout / no accessible Global Administrator case.

You can start here:

Microsoft Entra – Get support

If you prefer to call Microsoft Support, the exact phone menu depends on your country or region. In some countries, there is an initial message telling you to visit the online support page. You can simply wait for the menu options.

In other countries, the call may be handled by an automated conversation. For example:

  1. What kind of problem are you concerned about?
    1. Authenticator
  2. What kind of product are you using?
    1. Office 365 for business/Azure portal/Entra ID
  3. Is this an education or company account?
    1. Company
  4. Are you an administrator?
    1. Yes
  5. Do you have another administrator in your organization?
    1. No
  6. You need to create a service request.
    1. Yes

The exact wording may differ depending on the country and the current phone system, but the important part is to get the call converted into a support/service request.

Once you reach a support engineer, I would be very explicit:

“This is a Microsoft Entra tenant lockout. The only Global Administrator account is no longer accessible, and there are no other Global Administrators in the tenant. We need to recover administrative access to the tenant. Please escalate this case to the Data Protection / Tenant Recovery team.”

Have the following information ready for the ownership verification:

  • Tenant ID
  • Initial *.onmicrosoft.com domain
  • Custom domain name(s)
  • Proof of domain ownership / DNS access
  • Microsoft 365 subscription and billing information
  • Company information
  • Details about the previous Global Administrator
  • Any other information Microsoft requests to verify ownership

For future protection, I would also recommend having at least two independently managed Global Administrator accounts and dedicated emergency access accounts. This prevents losing access to the entire tenant when a single administrator account becomes unavailable.

If this answers your query, please click Accept Answer and Upvote if you found it helpful. If you have any further questions, feel free to let us know.

Was this answer helpful?

1 person found this answer helpful.
0 comments

1 additional answer

Sort by: Oldest
Most helpful Newest Oldest
  1. KAMRAN ALI 240 Reputation points
    2026-08-27T17:54:47.77+00:00

    Dear Maria Hernandez,

    Good day! Welcome to the Microsoft Q&A forum!

    Based on your description, I understand that you are the sole Global Administrator for your Microsoft 365 tenant and have lost access to the phone containing Microsoft Authenticator. Since there is no other Global Administrator or alternate MFA method available, you are unable to complete authentication.

    For security reasons, Microsoft Q&A cannot reset MFA or directly recover administrator access to a tenant. In this situation, the appropriate path is to contact Microsoft Support and request tenant/account recovery for a locked-out Global Administrator. Be prepared to provide the tenant and billing information and complete the required ownership verification.

    You can start the process through the Microsoft 365 admin support channel. If you cannot sign in to the admin center, use Microsoft's support/contact options and explain that you are the sole Global Administrator locked out by MFA with no alternate administrator.

    Please avoid creating another tenant or making changes to the existing tenant while recovery is in progress, as this will not resolve the MFA registration issue.

    I hope this helps point you in the right direction. Please let us know if you need further assistance. Thanks

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.