'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix Microsoft 365 Business MFA Sign-In Loop and Error 500121
Question details
A Microsoft 365 Business Global Administrator is locked out due to an unconfigured Microsoft Authenticator method, resulting in an MFA sign-in loop and Error 500121.
- Product
- Microsoft 365 Business
- Device & OS
- not provided
- Scenario
- Attempting to sign in to the administrator account without a properly configured MFA authentication method or fallback option.
- Observed behavior
- The administrator is trapped in a continuous MFA sign-in loop, receives Error code 500121, and is entirely locked out of the tenant.
Take a screenshot or write down the exact Error Code (500121), Request ID, Correlation ID, and your Tenant information from the sign-in screen, as Microsoft Data Protection Support will require these to verify your identity.
Contact Microsoft Support for Tenant Recovery
Because you are the Global Administrator and have no alternative verification methods, only Microsoft Support can verify your identity and disable MFA to restore your access.
When a tenant's sole Global Administrator is locked out due to an MFA loop, there is no self-service bypass available. You must go through a manual identity verification process with the Microsoft Data Protection team.
Find the official Microsoft 365 Business support phone number for your country or region and initiate a support call.
Supply the support agent with your Tenant ID, Request ID, and Correlation ID from the Error 500121 screen.
Work with the Data Protection team to prove ownership of the domain and tenant. They may ask for DNS record modifications or billing information.
Once verified, wait for the support team to temporarily disable MFA on your admin account so you can sign back in.
Configure Emergency Access Accounts (Break-Glass)
After regaining access to your tenant, immediately set up alternative authentication methods and a fallback account to prevent future lockouts.
Switch to WPS Office for a Hassle-Free Experience
If you are frustrated by complex tenant configurations, mandatory cloud policies, and administrative lockouts in Microsoft 365, consider WPS Office. It provides powerful document editing capabilities without requiring complex cloud admin setups, offering a lightweight and highly compatible offline alternative.
Frequently Asked Questions
What does Microsoft Error 500121 mean?
Error 500121 occurs when authentication fails during the Multi-Factor Authentication (MFA) process. This usually happens if the Microsoft Authenticator app is not set up correctly, the user replaces their phone without migrating the app, or if the authentication request is denied.
Can I bypass MFA if I am the only Global Admin?
No. If you are the sole Global Administrator and lose access to your only configured MFA method, you cannot bypass the security requirement yourself. You must contact Microsoft Support to prove ownership and regain access.
How can I avoid the MFA sign-in loop in the future?
To prevent future lockouts, always configure at least two authentication methods (like the Authenticator app and a backup phone number) for your main account. Additionally, set up a 'break-glass' emergency Global Admin account that is excluded from MFA policies.
How long does it take Microsoft Support to unlock a Global Admin account?
Timelines vary depending on the queue of Microsoft's Data Protection team. Because of strict security verification procedures to prevent unauthorized access, recovery can range from a few days to over a week.
