Sole Global Administrator locked out of Entra tenant because Authenticator MFA registration is missing

Question

Sole Global Administrator locked out of Entra tenant because Authenticator MFA registration is missing

Danny Ver 0

I am the sole Global Administrator of a Microsoft Entra/Azure tenant and cannot access it because its Microsoft Authenticator registration is no longer available.

I know the correct username and password and still control the associated email address. However, after entering the password, the sign-in page offers only these two verification methods:

Approve a request in Microsoft Authenticator

Enter a six-digit verification code from Microsoft Authenticator

Neither method works. Authenticator contains only my personal Microsoft-account entry for the same email address. That entry generates an eight-digit code, which is unrelated to the six-digit Entra MFA request. There is no separate work/school or tenant-specific account entry, and no approval request arrives.

There are no alternative methods such as SMS or telephone verification, and there is no other Global Administrator who can reset my authentication methods.

I also attempted to create a support request from another accessible Azure tenant. The support workflow provided only self-help guidance and did not give me a way to open a tenant-recovery case.

Because I cannot complete MFA, I cannot access the Azure portal, Entra admin center, Security Info page, or the normal support-request page for the affected tenant.

What is the current no-sign-in procedure for opening a Data Protection/Tenant Recovery case for a sole Global Administrator MFA lockout? Can a Microsoft moderator provide the appropriate private escalation channel so I can securely provide the affected tenant domain, tenant ID, administrator address, and ownership or billing evidence?

Please do not suggest resetting the password or selecting “Sign in another way”; the password is known, and the only two methods displayed both depend on the missing Authenticator registration.

0 comments

1 answer

Your answer

Answer 1

Dear Danny Ver,

Based on what you described, since you are the only active Global Administrator, there is no self-service recovery path available inside the tenant. Recovery must go through Microsoft's support and verification workflow, and only Microsoft's Data Protection / Tenant Recovery team can assist after verifying ownership of the tenant.

Note: Please understand that this is a community forum. As a forum user, I do not have access to Microsoft's internal systems, cannot engage the Data Protection team directly, and cannot provide a private escalation channel myself.

In this case, the suggestions I provided are based on what I have observed from many similar cases I have seen in the forum community.

If your Microsoft 365 subscription was purchased through a partner or reseller, please contact them immediately. The reseller can open a support request on your behalf when the tenant administrator cannot access the portal.

If your Microsoft 365 subscription was purchased directly from Microsoft, here are some options I recommend you look through and try:

Option 1: Try to contact Microsoft Data Protection Support by phone (Primary Method)

For a full list of regional numbers, you can also visit this official page: Customer service phone numbers - Microsoft Support. The support team will assist you as soon as possible. For reference:  Get support | Microsoft Docs   

Note: You may also consider calling a Microsoft support number for a different region if support in your local region is unavailable or unable to route your case appropriately.

(While calling, you may hear an introduction of about 30 seconds, such as "you can visit the link...". You can ignore it and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)

Here are some tips and an example of a prompt to help you navigate the IVR more effectively:

In some countries, it is an automated conversation like this: First, when you call the hotline, you will be asked as follows:

IVR: What kind of problem are you concerned about?

You: Authenticator.

IVR: What kind of product do you use?

You: Office 365 for business.

IVR confirmation: education or company account?

You: For companies

IVR: Are you an administrator?

You: Yes.

IVR: Do you have the other administrator in your organization?

You: No.

IVR: Do you need a... Service request?

You: Yes

This process should connect you with a live agent who will create a service request with the Data Protection team. They will then contact you to help you regain access.

Option 2: Create a Temporary Account (Trial Tenant) to Submit a Support Ticket (Alternative Method)

If the automated phone system does not get you to a human agent, one workaround is to create a separate trial Microsoft 365 tenant and use that tenant to open a support ticket on behalf of the locked tenant.

Sign up for a new Microsoft 365 Business trial using this link: Compare All Microsoft 365 Plans. You will need to use a different, personal email address to register.
Once the trial account is created, log in to its Admin Center > From the Admin Center, open a new Service Request. For reference:  Get support | Microsoft Docs   
In the ticket description, explain that you are locked out of your primary tenant (your.onmicrosoft.com) and that you need to speak with the Data Protection team to regain access.
Remember to provide your locked account's details and a good contact number for them to reach you.

Important:

- Please remember to cancel the trial subscription after your original account issue is resolved to avoid any future charges.

- When creating the support request, I also recommend disabling or bypassing the AI/Support Assistant option if presented and choosing the path that allows you to contact a support engineer directly.

User's image

I hope the information shared is helpful. If you have any questions or are stuck on any steps, please feel free to reach out. I'm looking forward to your update.