MFA & Verification Issues

How to Recover Microsoft Authenticator for a Sole Global Administrator

John Wilson Sep 29, 2026 871 views

Question details

The user is the only global administrator for a Microsoft 365 tenant and has lost the phone equipped with the Microsoft Authenticator app, leaving them completely locked out.

How to Recover Microsoft Authenticator for a Sole Global Administrator

Product: Microsoft 365
Device & OS: not provided
Scenario: Attempting to sign in to the Microsoft 365 Admin Center without access to the primary multi-factor authentication (MFA) device or alternative verification methods.
Observed behavior: The administrator cannot bypass the MFA prompt to access the tenant, and self-service recovery is unavailable because no other administrators or backup authentication methods exist.

Before you start

Gather your tenant information, custom domain names, and proof of identity, as Microsoft Support will require you to verify domain ownership before resetting your multi-factor authentication.

Solution 1Recommended

Contact Microsoft 365 Business Support by Phone

Call Microsoft directly to reach the Data Protection team, who can manually verify your identity and reset your MFA settings.

Since you are the sole administrator and cannot use self-service password reset tools, the only direct way to regain access is through Microsoft's official business support channels.

Locate the support number

Visit the official Microsoft Customer Service phone numbers page to find the dedicated business support phone number for your specific country or region.

Call support

Dial the number and follow the automated prompts to reach the Microsoft 365 Business support team. Explain that you are a sole global administrator completely locked out of your Authenticator app.

Verify domain ownership

Provide the support agent with your tenant details. You will be asked to prove administrative control, which typically involves adding a specific TXT record to your domain's DNS host.

Contact Microsoft 365 Business Support by Phone

Solution 2

Create a Temporary Trial Account to Open a Support Ticket

If you cannot reach phone support, you can create a temporary, free Microsoft 365 trial tenant to access the online support ticketing system.

Free Microsoft Office alternative

Stay Productive with WPS Office During Microsoft 365 Downtime

While you wait for Microsoft Support to restore your admin access, you don't have to stop working. WPS Office is a free, lightweight, and powerful alternative that lets you view, edit, and create documents seamlessly without relying on a cloud account.

1. Download the installer: Visit the official WPS Office website and download the free installer for your operating system.
2. Install the software: Run the setup file and follow the quick installation prompts to get WPS Office running in minutes.
3. Open your local files: Double-click your existing Microsoft Word, Excel, or PowerPoint documents to open and edit them seamlessly in WPS Office.

Completely free to use with a familiar, user-friendly interfaceHighly compatible with Microsoft Office formats like .docx, .xlsx, and .pptxWorks fully offline, keeping your local workflow uninterruptedLightweight installation that won't slow down your computer

microsoft office alternative - wps office

Frequently Asked Questions

Can I bypass Microsoft Authenticator if I am the only global admin?

No. If you have not configured alternative verification methods (like an alternate phone number or secondary email) beforehand, you cannot bypass the Authenticator prompt. You must contact Microsoft Support to verify your identity and reset your MFA settings.

How long does it take for Microsoft to reset my MFA?

Because this requires the Microsoft Data Protection team to rigorously verify your identity and domain ownership to prevent unauthorized access, the process can take anywhere from a few hours to several days.

How can I prevent getting locked out of my Microsoft 365 admin account in the future?

To prevent future lockouts, it is highly recommended to create at least one 'break-glass' or emergency access global admin account that is excluded from conditional access MFA policies, or ensure you have multiple global admins and alternative authentication methods registered.

Login & Account Issues