Tenant compromised – all Global Admins removed, domain still under control

Hi @Інформаційно-обчислювальний центр.Vkt,

Thank you for reaching out and for providing such a detailed explanation of the situation.

I fully acknowledge the seriousness of the situation you have described and understand how disruptive this must be for you, particularly given the potential security implications for an educational institution and the extended loss of administrative access. Moreover, I sincerely appreciate the time and effort you have invested in clearly documenting the timeline, previous support interactions, and associated risks, as this information is essential for addressing an issue of this nature.

As forum moderators, we unfortunately do not have access or control over user accounts, including login issues, password resets, or access changes. I truly understand how frustrating this can be, and I want to make sure you’re supported in the right way.  

Since all Global Administrator accounts have been removed and no one currently has access to the Admin Portal, this situation requires immediate contact with Microsoft’s Data Protection Team via phone support and only the Data Protection Team has the necessary permissions to reset your account from the backend. They are the designated and authorized team for handling account-related issues of this nature.  

1/ Contact Microsoft Data Protection Support by Phone (Primary Method)   

I understand that you have already attempted to reach Microsoft Support by phone and were unable to successfully open a case through the IVR system. I truly regret that experience. If possible, I kindly ask that you try again using the guidance below, as phone-based escalation remains the fastest and most effective path for incidents involving the loss of all Global Administrators.

To regain access when the Admin Portal is unavailable, please contact Microsoft Global Customer Service using the official support numbers listed here: Customer service phone numbers - Microsoft Support. During the call, please request to speak directly with a live support agent, and clearly explain:

• All administrative access has been lost
• There is suspected unauthorized privilege escalation or tenant compromise
• You need escalation to the Microsoft Data Protection / Security team

Providing these details upfront will help ensure your request is routed to the appropriate team with the authority to handle tenant recovery and security incidents.

Here are some tips and an example of a prompt to help you navigate the IVR more effectively:   

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)         

In some countries, it is an automated conversation like:  

IVR: What kind of problem are you concerned about?        

You: Can't access Global Admin.

IVR: What kind of product do you use?        

You: Office 365 for business.        

IVR confirmation: education or company account?        

You: For companies        

IVR: Are you an administrator?        

You: Yes.        

IVR: Do you have another administrator in your organization?        

You: No.  

IVR: Do you need a... Service request?       

You: Yes. I need to create a ticket. Please send me direct to the Data Protection Team.    

 When you connect with the team, having these documents ready can help speed up verification: 

• Domain ownership (DNS management access) 
• Billing/subscription details (payment methods, account history) 
• Tenant ID of the locked organization 
• Business registration documents 
• Authorized signatory documentation 

2/ Create a Temporary Account (Trial Tenant) to Submit a Support Ticket (Alternative Method)

If you still cannot reach to a live agent, there is still a workaround, you might consider registering for a new tenant by signing up for a trial subscription via this link Microsoft 365 Business Plans and Pricing | Microsoft 365. This would allow you to create a new tenant following the prompts provided. Once set up, you can access the admin console of the new tenant and submit a support ticket requesting to speak with the Data Protection team on behalf of your previous tenant.        

Please remember to cancel the trial subscription after your issue is resolved, as this will help you avoid any accidental billing. You may prefer the following resource for detailed instructions: Cancel your Microsoft business subscription in the Microsoft 365 admin center | Microsoft Learn.

I sincerely hope these instructions help you regain access as soon as possible. Please let me know once you have contacted the Data Protection team, or if you need further guidance at any stage.

Your patience and cooperation are greatly appreciated, and your contributions will also help others in the community who may encounter similar situations.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".        

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.