Microsoft 365 Business - Sole Global Administrator locked out after UPN change - Tenant Recovery required

Slightly Perturbed 0 Reputation points
2026-09-17T14:22:12.8766667+00:00

I am the sole Global Administrator of a newly created Microsoft Entra tenant and I am completely locked out after changing the User Principal Name (UPN) of the only administrator account.

I changed the administrator UPN from the tenant's original onmicrosoft.com domain to a verified custom domain. After signing out, neither the old nor the new UPN is recognised

The Microsoft sign-in page reports:

This username may be incorrect. Make sure you typed it correctly. Otherwise, contact your admin.

There are no other Global Administrators or emergency access accounts in the tenant, so I cannot restore access from within Microsoft Entra. I have already tried:

  • Waiting for the UPN change to propagate
  • Signing in from a private/incognito browser
  • Signing in with both the old and new UPNs
  • Microsoft telephone support Telephone support collected my contact details and issue description, but the call ended without providing a case number or confirming that a support request had been created.

I still control the verified custom domain and DNS and can provide proof of domain ownership, company information, billing information, the exact tenant name, the old and new UPNs, and any other ownership evidence privately.

Please can a Microsoft moderator engage the Data Protection / Tenant Recovery team or assist with creating a support ticket for this sole Global Administrator tenant lockout? I will provide all tenant-specific and personal information privately rather than posting it publicly if that's OK?

Microsoft Security | Microsoft Entra | Other
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Bence Weiszmann 1,725 Reputation points
    2026-09-17T14:29:52.7333333+00:00

    Dear @Slightly Perturbed

    If you don’t have any other alternative authentication method available, you will need to contact the Microsoft Data Protection Team using the following link and the methods described above. They can assist with recovering access when you’re unable to complete the verification process using your existing authentication methods. You can start the following link: https://support.microsoft.com/en-us/support/

    Some countries, the call may be handled by an automated conversation. For example:

    1. What kind of problem are you concerned about?
      1. Authenticator
    2. What kind of product are you using?
      1. Office 365 for business/Azure portal/Entra ID
    3. Is this an education or company account?
      1. Company
    4. Are you an administrator?
      1. Yes
    5. Do you have another administrator in your organization?
      1. No
    6. You need to create a service request
      1. Yes

    Once you reach a support engineer, I would be very explicit:

    “This is a Microsoft Entra tenant lockout. The only Global Administrator account is no longer accessible, and there are no other Global Administrators in the tenant. We need to recover administrative access to the tenant. Please escalate this case to the Data Protection / Tenant Recovery team.”

    Have the following information ready for the ownership verification:

    • Tenant ID
    • Initial *.onmicrosoft.com domain
    • Microsoft 365 subscription and billing information
    • Company information
    • Details about the previous Global Administrator
    • Any other information Microsoft requests to verify ownership

    Other option would be to create a temporary Microsoft 365 tenant using a trial subscription. You can then use this tenant to access the Microsoft 365 Admin Center and contact Microsoft Support. Once the new tenant is set up, sign in to the Microsoft 365 Admin Center and go to Support › Help & Support. Open a new support request and explain that you need help recovering access to your original tenant. In the request, mention that you are the Global Administrator of the original tenant and that you are currently locked out because you no longer have access to the MFA method required to sign in. One important thing the trial tenant is only needed to contact Microsoft Support. After you regain access to your original tenant and the issue has been resolved, remember to CANCEL the trial subscription so you don't accidentally get charged.

    Microsoft's instructions for cancelling a trial subscription can be found here: https://learn.microsoft.com/en-us/microsoft-365/commerce/subscriptions/cancel-your-subscription?view=o365-worldwide&#how-do-i-cancel-my-free-trial

    Best regards,
    Bence

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.