Tenant lockout – lost MFA access – need Data Protection / Tenant Recovery assistance

Question

Tenant lockout – lost MFA access – need Data Protection / Tenant Recovery assistance

Tomasz Ściepłek 20

Hello,

I need assistance recovering access to a Microsoft Entra tenant.

I have access to the administrator account and know its password, but I no longer have access to the Microsoft Authenticator registration associated with the account. There are no alternative authentication methods available, so I cannot complete MFA.

I also don't have access to another administrator in the affected tenant who could reset the authentication methods.

I have already tried contacting Microsoft Support through another tenant, but the Microsoft 365 Support Assistant repeatedly fails with FlowActionBadRequest. I also tried creating a support request through the Entra/Azure portal, but technical support there requires a paid Azure support plan.

I have full control over the DNS of the company's custom domain and can prove domain ownership by adding a DNS TXT record if required.

Could a Microsoft moderator please help me open/escalate a support case to the Data Protection / Tenant Recovery team so that ownership can be verified and the administrator's MFA registration can be reset?

I can provide the Tenant ID, tenant domain, affected administrator UPN and other company information privately.

0 comments

Answer accepted by question author

Chris-D 1,515 Independent Advisor

Hi Tomasz,

Thank you for sharing the details of your situation.

As this is a user-to-user support forum, I can only offer guidance based on similar cases. I do not have access to your tenant or account. Only Microsoft Support can verify the tenant status, assist with Global Administrator or MFA recovery, and determine the available recovery options.

Based on your description, I recommend trying the following options:

1/ Turn off Support Assistant and try creating the support request again

Since the Microsoft 365 Support Assistant is returning the FlowActionBadRequest error, please try turning off Support Assistant and using the classic support experience:

In the Microsoft 365 admin center, open Help & support.
Turn off Support Assistant.
In the search box, briefly describe the issue, for example: "Admin locked out due to MFA"
Select the Contact Support headset icon.
Choose an available contact method, such as phone or email, enter your contact details, and submit the request.

If you are performing these steps from another tenant, please explain clearly that the support request concerns a different tenant where the only administrator is locked out because the registered MFA method is no longer accessible.

2/ Contact Microsoft Data Protection Support by phone

If the first option does not work, please try contacting Microsoft Support by phone. You can find the appropriate hotline for your country or region here: Customer service phone numbers - Microsoft Support

User's image

Here are some tips and an example of a prompt to help you navigate the IVR more effectively:

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)

In some regions, the initial interaction may be automated, so here’s a general idea of how the conversation might go to help you prepare:

What kind of problem are you experiencing?
Answer: Authenticator
What products do you use?
Answer: Office 365 for business
Is this for an education or company account?
Answer: For companies
Are you an administrator?
Answer: Yes
Are there any other administrators in your organization?
Answer: No. I am the only admin in my tenant
Do you need a... Service request?
Answer: Yes. I need to create a ticket. Please send me direct to the Data Protection Teams.

During the phone call, you will need to provide the information associated with your subscription, such as your company name, billing details, phone number, and an alternate email address, etc. This information allows the Data Protection team to verify your identity and securely assist you in regaining access to your administrator account.

I also recommend calling during business hours. In my experience, it can be difficult to get through to the correct support queue, and automated systems don't always work as expected. If you can't get through on your first try, I suggest trying again later or at a different time.

I hope these steps help you create a support ticket successfully and move closer to regaining access to your administrator account. While I’m not able to intervene directly, guiding you to the right support team is the most effective help I can provide here.

Hope you're able to get this resolved soon.

If the answer is helpful, please click "Yes" and kindly upvote it. If you have any extra questions about this answer, please click "Comment".

Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

0 comments

1 additional answer

Your answer

Answer 1

This scenario is a tenant lockout. When the only administrator can’t complete MFA and no other Global Administrator can reset authentication methods, recovery requires Microsoft Support identity verification.

Supported recovery path:

Try the standard recovery entry points first:
- Go to the admin portal and attempt sign-in with the affected admin account.
- If prompted to request admin access, follow those steps.
- Use the Self Service Password Reset tool if it is offered for the account.
If MFA still blocks access, open a Microsoft support case for tenant recovery:
- Use the Microsoft 365 support page and select I can't sign in or access my tenant.
- If portal access is unavailable, call the published Microsoft customer service or Microsoft 365 business support numbers for the country or region.
Be prepared for Microsoft’s high-assurance identity verification process. Verification can include:
- Official business documentation
- Domain ownership
- Publicly listed organization or nonprofit registration data
If ownership is verified, Microsoft recovers access to the existing tenant. Microsoft does not issue a new tenant.
If a partner created or manages the tenant and has active GDAP with the required roles, that partner should work directly on password reset or admin recovery. If no partner has the needed access, the tenant owner must contact Microsoft Support.

The documented escalation path for this condition is Microsoft Support / tenant recovery. Community examples for the same “only Global Admin lost MFA” scenario show escalation to the Data Protection team through a support ticket, after which Microsoft contacts the tenant owner to restore access.