Locked out of admin account after changing phone – lost Microsoft Authenticator access

Because the account is a global admin and the only registered MFA method (Microsoft Authenticator on the old phone) is no longer available, the reset path depends on whether there is any other global admin in the tenant.

1. If there is another global admin in the tenant
   1. That admin signs in to the Azure portal and opens Microsoft Entra ID.
   2. Go to Users → select the locked-out admin account.
   3. Open Authentication methods.
   4. Select Require re-register multifactor authentication.
   5. Next time the locked-out admin signs in, the sign-in flow will prompt to set up MFA again on the new phone (scan QR code in Microsoft Authenticator, etc.).
2. If there is no other global admin (you are the only one) In this case, only Microsoft’s Data Protection / Tenant Recovery process can restore access. Forum moderators or normal support agents cannot directly change MFA for the account. Use one of these supported options: Option A – Call Microsoft Data Protection via global support phone
   1. Call the appropriate number from Customer service phone numbers - Microsoft Support.
   2. When the IVR asks what the problem is, clearly indicate it is an Authenticator / MFA issue for Office 365 for business.
   3. When asked:
      • Product: “Office 365 for business” (or Microsoft 365 for business).
      • Account type: “Company account.”
      • Are you an administrator?: “Yes.”
      • Are there any other administrators?: “No.”
      • Do you need a service request?: “Yes – I need the Data Protection team to help with admin MFA reset / tenant recovery.”
   4. The frontline agent should create a ticket and route it to the Microsoft 365 / Azure Data Protection team.
   5. The Data Protection team will verify identity and ownership of the tenant and then reset the admin’s MFA registration so a new device can be enrolled.
   Option B – Create a temporary trial tenant to open a support ticket (if phone support is hard to reach)
   1. Sign up for a new Microsoft 365 trial tenant (any business/enterprise trial).
   2. In that new tenant, go to the Microsoft 365 Admin Center → Support → Help & support.
   3. Open a support ticket explicitly stating:
      • You are locked out of a different, existing tenant (firmfoundationedu.onmicrosoft.com).
      • You are the only global admin.
      • MFA is enforced and only Microsoft Authenticator was configured on a lost/changed phone.
      • You need the Data Protection team to reset MFA for the global admin account on that original tenant.
   4. Work with support/Data Protection as they verify identity and perform the MFA reset.
   5. After recovery, cancel the trial tenant to avoid charges.

Once Data Protection or another global admin has required MFA re-registration, sign in again with the global admin account; the sign-in flow will bypass the old Authenticator and instead prompt to configure Microsoft Authenticator on the new phone (or another MFA method).

References:

• You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
• Troubleshoot sign-in issues and account access problems
• Global Admin Locked out - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• Microsoft authenticator sending me into a spiral - Microsoft Q&A
• Use a screen reader to set up and troubleshoot multifactor authentication