'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix Microsoft 365 Only Administrator Cannot Sign In (MFA Issue)
Question details
The user is locked out of their Microsoft 365 tenant because they are the sole global administrator and have lost access to the Microsoft Authenticator app required for multi-factor authentication (MFA).
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Attempting to sign in to the Microsoft 365 admin center as the only global administrator in the tenant.
- Observed behavior
- Sign-in is blocked because multi-factor authentication (MFA) cannot be completed without the Authenticator app, and there are no other administrators to reset the MFA requirement.
Before proceeding, check if you can recover the Microsoft Authenticator app from a cloud backup on your current or previous mobile device, as this is the fastest way to regain access to your account.
Recover Microsoft Authenticator App from Backup
Restore your authenticator credentials from a cloud backup if you previously enabled the backup feature on your phone.
If you backed up your Authenticator app using a personal Microsoft account or iCloud, you can seamlessly restore your MFA tokens to a new or reset device. This allows you to immediately bypass the admin lockout without contacting support.
Install the Microsoft Authenticator app on your mobile device from the App Store or Google Play.
Open the app and tap 'Begin Recovery' at the bottom of the screen before signing in with any account.
Sign in with the personal Microsoft account that you originally used to back up your Authenticator app.
Once the accounts are restored, open a web browser, sign in to Microsoft 365, and approve the prompt using your newly recovered app.
Contact Microsoft Data Protection Support
If recovery is impossible and you are the only admin, you must contact Microsoft Support to prove ownership and reset your MFA.
Need a hassle-free productivity suite? Try WPS Office
While you wait for your Microsoft 365 account recovery, keep your business running smoothly with WPS Office. It provides powerful word processing, spreadsheet, and presentation tools without the complex tenant management and strict MFA sign-in lockouts.
- 1. Download the Installer: Visit the official WPS Office website and download the free installer for your operating system.
- 2. Install WPS Office: Run the setup file and follow the on-screen instructions to complete the fast installation process.
- 3. Open Your Office Files: Launch WPS Office and directly open your existing Word, Excel, or PowerPoint files to continue working seamlessly.
Frequently Asked Questions
How can I prevent being locked out of Microsoft 365 as an admin again?
Always configure at least one 'break-glass' emergency access admin account that uses a different authentication method or is excluded from certain conditional access policies. Additionally, set up alternative verification methods like a phone number or hardware token.
Can another user in my organization reset my MFA?
No, standard users do not have the administrative privileges required to reset multi-factor authentication settings. Only another user with Global Administrator rights can reset your MFA methods.
What happens to my company data if I cannot recover the admin account immediately?
Your tenant data remains perfectly intact and secure. However, you will not be able to manage users, billing, or global settings until Microsoft Data Protection successfully verifies your identity and resets the MFA requirement for your administrator account.
