Only Global Admin locked out – MFA SMS Error 399287

Hi Robert,

I hope you're doing well.

Based on the information provided, Error Code 399287 is often associated with Microsoft's risk assessment and phone reputation systems, which can block SMS-based multi-factor authentication (MFA) requests even when the registered phone number is valid, active, and able to receive text messages. As a result, authentication attempts may fail despite the phone number itself not having any connectivity issues.

If your account is also an admin account and there are no other available global administrators in your tenant, then the only way to regain access is contact Microsoft support. Please try locating the appropriate hotline for your region here: Customer service phone numbers - Microsoft Support 

In this situation, the Microsoft Data Protection team has tools and processes in place to verify identity and regain access to administrator accounts. 

When contacting Microsoft, be prepared to verify ownership of the subscription. You may be asked for information such as:

• Organization name
• Billing or payment information
• Registered phone number
• Alternate email address

Once your identity is verified, the privacy team will be able to reset your MFA settings. You can then reset your account in the Microsoft Authenticator app on your new device or choose a different authentication method to sign in.

Here are some tips and an example of a prompt to help you navigate the IVR more effectively: 

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)   

In some regions, the initial interaction may be automated, so here’s a general idea of how the conversation might go to help you prepare:     

• IVR: What problem is bothering you?
• Client: Lost access to the only admin account
• IVR: What product do you use?
• Customer: Office 365 for business
• IVR: School or Business Account?
• Client: Companies
• IVR: Are you an administrator?
• Client: Yes
• IVR: Is there another administrator in your organization?
• Client: No. I am the only admin in my tenant    
• IVR: Do you need to create a support ticket?
• Client: Yes. I need to create a ticket. Please send me direct to the Data Protection Teams.

In case you are unable to contact the frontline support:

Consider signing up for a trial subscription to create a new tenant: Microsoft 365 Business Plans and Pricing | Microsoft 365.

Once set up, you can access the new tenant's admin console and submit a support ticket to speak with the data protection team on behalf of the previous tenant. Once your issue is resolved, please remember to cancel the trial subscription to avoid any unintended charges.

If your organization's subscription is from a partner or reseller: Contact the reseller's support provider to help open a service request on behalf of you instead.

I hope this helps point you in the right direction. If you have any updates or additional questions, feel free to reply back and I'll do my best to assist further.

Best regards.

If the answer is helpful, please click "Yes". If you have extra questions about this answer, please click "Comment".