How to Reset Microsoft Authenticator When the Only Admin Lost Phone Access
Question details
The user needs to regain access to their Microsoft 365 tenant after losing access to the Microsoft Authenticator app, specifically when they are the only global administrator.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- The sole Microsoft 365 administrator lost their phone or deleted the Authenticator app and cannot approve their own sign-in request.
- Observed behavior
- The administrator is completely locked out of the tenant because multifactor authentication requires approval from an inaccessible device, and no other admin exists to perform an MFA reset.
Gather your tenant details, including your domain name, administrator email address, and any billing information, as Microsoft support will require this to verify your identity.
Contact Microsoft Data Protection Support for Tenant Recovery
Since you are the sole administrator, you cannot reset the MFA yourself. You must contact Microsoft support directly to verify your identity and perform a backend MFA reset.
Standard users can have their MFA reset by an administrator. However, when the only global administrator is locked out, Microsoft's Data Protection or Identity Management team must intervene to secure and restore access.
Visit the official Microsoft 365 admin help page (https://learn.microsoft.com/en-us/microsoft-365/admin/get-help-support) to locate the specific business support phone number for your region or country.
Dial the support number and clearly state to the automated system or representative that you are the sole global administrator completely locked out of your tenant due to lost MFA access. Request to be transferred to the Data Protection team.
Provide the requested tenant information, domain details, and billing data to the support agent so they can verify your legal ownership of the account.
Once your identity is verified, the Microsoft team will manually reset your multifactor authentication from their backend. You will then be able to log in with your password and register a new authentication method.
Looking for a Hassle-Free Office Suite? Try WPS Office
While waiting for your Microsoft 365 admin account recovery, consider WPS Office as a lightweight, free alternative for your daily document needs. It offers seamless compatibility with major office formats without requiring complex tenant or MFA management.
Frequently Asked Questions
How long does it take for Microsoft Data Protection to reset my MFA?
The process can take anywhere from a few hours to several days, depending on the current support volume and how quickly you can provide the necessary verification documents to prove tenant ownership.
Can another user in my organization reset my Microsoft Authenticator?
Only users assigned the Global Administrator or Privileged Authentication Administrator role can reset MFA for other users. If you are the only user with these roles, you must contact Microsoft Support.
What is a break-glass administrator account?
A break-glass account is an emergency-only global administrator account configured with a highly secure, complex password and excluded from standard MFA policies. It ensures you never lose access to your tenant if your primary admin account is locked out.
Can I restore my Microsoft Authenticator app on a new phone?
Yes, if you previously enabled cloud backup in the Microsoft Authenticator app on your old phone, you can recover your credentials on a new device by logging in with your personal Microsoft account during the app's initial setup.
