logo
search
MFA & Verification Issues

How to Change a Microsoft 365 Administrator Without the Former Admin's Phone

Emma BrownEmma Brown Sep 29, 2026 869 views

Question details

Need to change or recover a Microsoft 365 administrator account without access to the previous administrator's phone or MFA device.

How to Change a Microsoft 365 Administrator Without the Former Admin's Phone
Product
Microsoft 365
Device & OS
not provided
Scenario
A former Microsoft 365 administrator has left the organization, and their Authenticator app or phone is unavailable for multi-factor authentication (MFA) login.
Observed behavior
Unable to log in to the Microsoft 365 admin center or manage the tenant due to missing MFA access for the primary administrator account.
Before you start

Check with your team to see if there is another active Global Administrator account available in your Microsoft 365 tenant, as this will significantly speed up the recovery process.

Solution 1Recommended

Use Another Global Administrator Account

Use an existing alternative Global Administrator account to reset the former administrator's MFA methods and assign a replacement.

Microsoft 365 tenants often have more than one Global Administrator. If another admin can log in, they have the permissions required to reset the MFA settings for the locked-out account.

1
Log in to the Admin Center

Sign in to the Microsoft 365 admin center (admin.microsoft.com) using the secondary Global Administrator account.

2
Locate the Former Admin

Navigate to 'Users' and click on 'Active users'. Search for and select the former administrator's account.

3
Reset MFA Methods

In the user pane, click on 'Manage multifactor authentication'. Select the former admin's account and click 'Require selected users to provide contact methods again'. You can also delete their existing app passwords.

4
Assign a New Administrator

If you are setting up a replacement administrator, go back to 'Active users', select the new user, click 'Manage roles', and assign them the 'Global Administrator' role.

Use Another Global Administrator Account
Best Practice: Always ensure your tenant has at least two Global Administrators (a 'break-glass' account) to avoid being locked out if one admin leaves.
Free Microsoft Office alternative

Switch to WPS Office for Easier Team Management

Dealing with complex Microsoft 365 admin setups and MFA lockouts can be frustrating. Try WPS Office as a lightweight, free alternative that offers excellent compatibility with Word, Excel, and PowerPoint files without the administrative overhead.

  1. 1. Download WPS Office: Visit the official WPS Office website and download the free installation package for your operating system.
  2. 2. Install the Software: Run the installer and follow the simple on-screen instructions to set up the office suite on your device.
  3. 3. Open Your Files Seamlessly: Launch WPS Office and directly open your existing Microsoft Word, Excel, or PowerPoint files without losing formatting.
Highly compatible with Microsoft Office formats (.docx, .xlsx, .pptx)No complex tenant administration or MFA lockouts to worry aboutLightweight and fast to install on any deviceFree basic version includes powerful Word, PDF, and Spreadsheet tools
microsoft office alternative - wps office

Frequently Asked Questions

How long does it take for Microsoft Support to reset an admin account?

It typically takes a few days, and sometimes up to a week. The Microsoft Data Protection team must thoroughly verify your domain ownership and company identity to prevent unauthorized access to your tenant.

Can I bypass the Microsoft Authenticator app?

No. If multi-factor authentication (MFA) is strictly enforced on your tenant, you cannot bypass it. You must either use another Global Admin account to reset the MFA requirement or contact Microsoft Support for a manual override.

How can I prevent a total admin lockout in the future?

Always ensure your Microsoft 365 tenant has at least two Global Administrator accounts. It is highly recommended to create a dedicated 'break-glass' or emergency access account that is not tied to a single employee's personal phone.