Locked out of Azure/Entra tenant — MFA error 500121, no working Authenticator

Hi @Mario Raposo

Please understand that our forum is a public platform, and we will modify your question to cover your personal information including your organization domain name in the description. Please notice to hide these personal or organization information next time you post error or some information to protect personal data.

I have moved the information to the Private message if you need to add any more privacy information please add it in there.

Regarding your issue, the error 500121 indicates that the sign-in process is failing at the MFA stage meaning your password is accepted, but the verification through Microsoft Authenticator cannot complete (for example, no push notification is received or the code is rejected). 

At the same time, the error AADSTS16000 suggests that the account you are using (a personal Microsoft account from live.com) is not recognized in the tenant that the Azure portal is attempting to access. In this situation, the portal may route you to the default “Microsoft Services” tenant, where directory-level actions (such as accessing Entra ID or Support) are not available for your account. 

For more details, please refer to: AADSTS error codes

If there is no other Global Administrator available, there is no option to reset MFA or recover access from within the tenant, the best next step would be to contact Microsoft Data Protection team directly for assistance as they have tools and processes in place to verify identity and regain access to administrator accounts.      

You can find the appropriate customer service phone numbers at this link: Customer service phone numbers.

Depending on your country or region. For some countries, when calling the support number, although there are about 30 seconds opening as something "you can visit the link...." But you can ignore this opening and wait until the option, then "1" as a business email user, "1" again for technical help. Then you can follow the automated hotline flow to request a support ticket. 

Please provide the following details to the support team:   

• Tenant ID  
• Email address used to sign in  
• Correlation ID from the login failure  
• Timestamp of the failure  

Hopefully it clears thing up and if you have any other questions or need further assistance, feel free to ask.  

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Tenant-level MFA reset and Data Protection/Tenant Recovery escalation cannot be performed directly. In a tenant lockout scenario where no other global admin can sign in to re-register MFA, the documented path is to open a support ticket and have Microsoft Support/Data Protection handle the recovery.

From the referenced tenant-lockout case, the resolution was:

1. Open a support ticket for the affected tenant (Severity A / business down if applicable).
2. The support engineer engages the Microsoft Data Protection team.
3. Data Protection contacts the requester (email/phone) to validate ownership and then restores access to the tenant, including resetting MFA as needed.

Because access to the Azure Support Portal is failing with AADSTS16000 for the current account, use an alternative path to open the support case, for example:

• Use another work/school account that has access to Azure Support for the same subscription/tenant, if one exists, and clearly state that the primary admin account is locked out due to MFA and that no other global admin is available.
• If there truly is only one global admin and no other admin account is known, follow the same pattern as the documented Q&A case: request that Support escalate to the Data Protection team for tenant lockout / MFA reset and tenant recovery.

Once Support/Data Protection completes their process and restores access, sign in and reconfigure MFA methods (for example, add additional methods such as phone or Microsoft Authenticator on a new device) so that a single-device failure does not cause another lockout.

References:

• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A
• Azure has blocked myphone number for SMS verification due to a “bad reputation” flag - Microsoft Q&A
• Common problems with two-step verification for a work or school account
• Frequently asked questions about Microsoft Entra multifactor authentication