Microsoft 365 Tenant Lockout – Global Administrator MFA Failure

Question

Microsoft 365 Tenant Lockout – Global Administrator MFA Failure

SHANIGMAIL 0

We are locked out of our Microsoft 365 tenant.

The Global Administrator password is known and accepted, but MFA / Microsoft Authenticator is no longer working.

There is no accessible alternate administrator account and no alternative sign-in method is available.

Tenant domain: shaniltd.net

Affected administrator: ******@shaniltd.net

Please escalate this case to the Microsoft Data Protection / Tenant Recovery team for tenant ownership verification and MFA reset.

We have access to the domain DNS and can add a TXT record if required for ownership verification.

0 comments

1 answer

Your answer

Answer 1

Bence Weiszmann 745

Dear @SHANIGMAIL

If there is no other Global Administrator available in the tenant, this needs to go through Microsoft's tenant recovery process.

I would recommend contacting Microsoft Support and explicitly describing this as a tenant lockout / no accessible Global Administrator case.

You can start here:

Microsoft Entra – Get support

If you prefer to call Microsoft Support, the exact phone menu depends on your country or region. In some countries, there is an initial message telling you to visit the online support page. You can simply wait for the menu options.

In other countries, the call may be handled by an automated conversation. For example:

What kind of problem are you concerned about?
1. Authenticator
What kind of product are you using?
1. Office 365 for business/Azure portal/Entra ID
Is this an education or company account?
1. Company
Are you an administrator?
1. Yes
Do you have another administrator in your organization?
1. No
You need to create a service request.
1. Yes

The exact wording may differ depending on the country and the current phone system, but the important part is to get the call converted into a support/service request.

Once you reach a support engineer, I would be very explicit:

“This is a Microsoft Entra tenant lockout. The only Global Administrator account is no longer accessible, and there are no other Global Administrators in the tenant. We need to recover administrative access to the tenant. Please escalate this case to the Data Protection / Tenant Recovery team.”

Have the following information ready for the ownership verification:

Tenant ID
Initial *.onmicrosoft.com domain
Custom domain name(s)
Proof of domain ownership / DNS access
Microsoft 365 subscription and billing information
Company information
Details about the previous Global Administrator
Any other information Microsoft requests to verify ownership

For future protection, I would also recommend having at least two independently managed Global Administrator accounts and dedicated emergency access accounts. This prevents losing access to the entire tenant when a single administrator account becomes unavailable.

If this answers your query, please click Accept Answer and Upvote if you found it helpful. If you have any further questions, feel free to let us know.

SHANIGMAIL 0 Reputation points

2026-08-25T09:46:47.9566667+00:00

Thank you.

I have already tried the Microsoft Support phone channels, but I am unable to reach a support engineer or create a service request because the tenant is completely locked out.

There is no accessible Global Administrator.

Could you please help escalate this case to Microsoft Data Protection / Tenant Recovery, or arrange a private message so I can provide the Tenant ID and ownership verification details securely?

This is an active production Microsoft 365 tenant and we currently have no administrative access.
Bence Weiszmann 745 Reputation points

2026-08-25T15:28:41.33+00:00

Unfortunately, I am not able to escalate the case directly to the Data Protection team on your behalf. The escalation has to be initiated through Microsoft Support, so I would recommend the following approach:

If you are unable to reach the appropriate team through phone or chat, one possible workaround is to create a temporary Microsoft 365 trial tenant. After signing up for the trial, you can access the Microsoft 365 Admin Center and raise a support request through Support > Help and Support: https://admin.microsoft.com/#/support/requests. Explain that your original tenant is locked and that there is currently no accessible Global Administrator, and specifically ask Microsoft Support to escalate the case to the Data Protection team. Once access to the original tenant has been recovered, make sure to cancel the trial subscription to prevent any unnecessary charges.

It is also a good idea to prepare the information required to verify ownership of the tenant before contacting Microsoft. This may include the tenant domain, previous billing or subscription information, company registration details where applicable, and any alternative contact details associated with the tenant. Having this information available can make the ownership verification process much quicker.

After you regain access, I would strongly recommend putting additional safeguards in place to prevent a similar situation in the future. At minimum, have another Global Administrator available and consider maintaining a dedicated break-glass emergency account. The emergency account should be designed specifically for recovery scenarios and appropriately excluded from policies that could prevent emergency access. Administrator accounts should also have multiple authentication methods registered, for example Microsoft Authenticator together with a security key or another supported method.

Since the Authenticator registration for this account is still present on your current phone and you can see both sign-in notifications and the TOTP code, keep that device available during the verification process. Although the existing registration may not be sufficient to complete the MFA setup or regain access by itself, it could still be useful during the identity and ownership verification process.
Bence Weiszmann 745 Reputation points

2026-08-26T20:31:01.0566667+00:00

Dear @SHANIGMAIL

I just wanted to follow up and check whether the issue is still occurring or if you were able to resolve it.

If the issue has been resolved, I would really appreciate it if you could mark the answer as accepted and upvote it if it was helpful.

If you have any further questions, please feel free to let us know.