'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Fix Microsoft 365 Administrator Account Locked Out by Two-Step Verification
Question details
The user needs to regain access to the sole Microsoft 365 administrator account after being locked out due to a changed mobile number preventing two-step verification.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Attempting to log in to the Microsoft 365 Admin Center without access to the previously registered two-step verification method.
- Observed behavior
- The system prompts for a two-step verification code from an old mobile number or an authenticator app that is no longer accessible, blocking the only administrator from signing in.
Gather your organization's domain details, subscription information, and proof of administrative authority before contacting support.
Contact the Microsoft Data Protection Team
Use this solution if you are the only global administrator for the organization and cannot use alternative sign-in methods.
When the only administrator is locked out, standard password reset tools will not work because the two-step verification requirement remains active. You must escalate the issue directly to Microsoft's Data Protection team.
The Data Protection team is responsible for securely verifying your identity and domain ownership before manually clearing the old MFA (Multi-Factor Authentication) settings from your account.
Visit the official Microsoft support page for global customer service phone numbers and find the number dedicated to your country or region.
Dial the number and follow the automated prompts for business support. Specifically request to speak with the Data Protection team regarding a locked-out global administrator account.
Provide the requested documentation to verify your identity, domain ownership, and administrative rights over the Microsoft 365 tenant.
Ask Another Administrator to Reset MFA
Use this method if your organization has more than one global administrator account.
Contact Your Microsoft Reseller
If you purchased your Microsoft 365 subscription through a third-party reseller or partner, they can often open an administrative support case on your behalf.
Try WPS Office as a Seamless and Lightweight Alternative
If you are locked out of your Microsoft 365 account but urgently need to edit documents, spreadsheets, or presentations, WPS Office is an excellent solution. It offers a free, lightweight suite that is fully compatible with Microsoft Office formats, allowing you to continue working locally without complex cloud administration.
- 1. Download the installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install the software: Run the installer and follow the quick on-screen instructions to set up the software.
- 3. Open your files: Launch WPS Office and immediately open your existing Microsoft Word, Excel, or PowerPoint files to continue working.
Frequently Asked Questions
Why is Microsoft Authenticator asking me for a code to log into the Authenticator app itself?
This happens when your authenticator app is set as the sole verification method for the account you are trying to configure. If you are stuck in this loop, select 'Sign in another way' on the login screen if available. If that is not an option, the MFA settings must be cleared by another admin or the Data Protection team.
Can I use self-service password reset if I lose my phone?
Self-service password reset (SSPR) will only work if you previously set up an alternative verification method, such as an alternative email address or a secondary phone number. If the lost phone was your only method, SSPR will fail.
How can I prevent being locked out as the only admin in the future?
Microsoft strongly recommends setting up an emergency access 'break-glass' administrator account. This account should have a highly secure password, not be tied to a specific individual's mobile device, and use a different authentication method (like a physical FIDO2 security key) that is stored securely in a physical safe.
