Cannot complete MFA – Admin access issue (E5 Developer tenant)

Hi @Trong Phat Nguyen 

I understand the difficulty you’re facing with your Microsoft 365 E5 Developer Program tenant. Since you cannot complete multi-factor authentication due to losing access to Microsoft Authenticator and no other Global Administrators in the tenant, you are effectively locked out of the Admin Center. Unfortunately, this type of MFA issue can only be resolved by the Microsoft Support team. You might need to contact them via phone service number: Customer service phone numbers - Microsoft Support. The agent will be able to create a ticket for you under the affected tenant and then transfer this ticket to Data Protection team who could help you to regain access.  

For future prevention, we strongly recommend designating at least two Global Administrators to avoid similar issues.  When a call is made to support, the first step is to provide an automated voice response from AI. Be careful, you won't be able to speak to a support representative if you don't respond appropriately here.  

Here's an example of a response that actually led to a support representative. Please refer to it. 

Q. Can you tell me if you are calling as a home user who uses a product or service at home or a business user who uses it in your business to provide the best assistance? 
A. I am a business user. 
Q. Thank you. Can you give me the details of your inquiry? 
A. Login technical support. 
Q. First of all, can you tell me which products you are inquiring about today? 
A. Microsoft 365 business Standard。 
Q. Please wait a moment, I understand Microsoft 365. Are you calling about a new case or an existing one? 
A. New. 
Q. To receive phone support, your phone number must be associated with your Microsoft 365 admin profile. To do this, go to aka.ms/m365profile. Again, it aka.ms/m365profile . This can take 48 hours. In the meantime, you can go to aka.ms/m365profile and file a case online. If you prefer, you can also text the link to the phone number you are calling. What do you think? 
A. The phone number is already linked to the link. 
Q. Can you tell me about the products in your inquiry? 
A. Microsoft 365 Business Standard. 
Q. Are you a Global Administrator? 
A. That's right. 
Q. I'm sorry. I didn't understand. Are you a global administrator for your domain? 
A. Yes, I am a global administrator for the domain. 
Q. If you have any inquiries, you can contact a Microsoft representative. Are you sure? 
A. Yes. Please. 
Q. Yes, I understand. One moment. 

Please note that this team is always overwhelmed, so you might need to wait for them to call you, this should take 3-10 working days. I know that this is not a convenient solution to hear but it seems to be the only way, and it's recommended that you should have a secondary/backup Global Administrator to fix this issue on your own.    

If you’re unable to reach support by phone, another option is to create a temporary tenant using a trial license:

-Go to Microsoft 365 Business Plans and Pricing and click Try for free to set up a temporary Microsoft 365 tenant with a trial license.    

-Use this new account to sign in to the Microsoft 365 Admin Center and submit a support request on behalf of your primary (locked) account.   

Note: This method doesn't require you to use your new account for your business. Instead, it allows you to create a temporary global administrator account so you can submit a support request, as your original global administrator account is locked out due to issues with multi-factor authentication. The trial account is free for one month. Be sure to delete it after submitting your support request to avoid any automatic renewals or charges from Microsoft.     

For further instructions, you can follow this guide: Get support - Microsoft 365 admin | Microsoft Learn.   

I appreciate your understanding and patience in this matter. While I truly want to assist you, this issue is beyond the scope of my role as a forum moderator. I do not have access to internal databases or the ability to escalate cases directly to Microsoft’s internal teams. Therefore, please kindly contact the Microsoft Support team for the most efficient help.   

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

sole GA loses all MFA → tenant has no trusted root, so u call M365 support + ask DP to reset factors. if still blocked, ask for ownership recheck + full MFA purge → then sign‑in clean + add MFA.

Because the account is protected by Microsoft Entra multifactor authentication and there is no working method available (lost Microsoft Authenticator, SMS failing, no alternative methods, and no other Global Administrators), the only supported path is to have MFA reset by an administrator or by Microsoft support after ownership verification.

Given the described situation, the applicable options from the provided material are:

1. If there is another Global Administrator (not the case here, but for completeness):
   • Another global admin signs in to the Microsoft Entra admin center.
   • Go to Users → select the affected user → Authentication methods.
   • Choose Require re-register multifactor authentication so that the next sign-in forces new MFA setup.
   This pattern is described in multiple Q&A resolutions where admins reset MFA for users.
2. If there is no other Global Administrator (sole admin locked out):
   • The account owner must work with Microsoft’s Data Protection / Tenant Recovery team via customer support. Forum moderators and self-service tools cannot override MFA in this case.
   • Use the global customer service phone channel for business/tenant issues as described in the Q&A guidance. When calling, clearly state:
     • The issue is with Microsoft 365 for business / developer tenant.
     • The caller is the only administrator and is locked out due to MFA.
     • Request creation of a service request with the Data Protection team to reset MFA / security info for the tenant admin.
   • The Data Protection team will verify tenant ownership and, if successful, reset MFA so that new methods can be registered at next sign-in.
3. If the tenant is associated with a partner/reseller (less typical for E5 Developer, but covered in the guidance):
   • The partner or reseller can help open a service request on behalf of the tenant admin if the admin cannot open one directly.

The context also shows that when phone-based MFA (text/voice) is blocked or fails, and no alternative method exists, the resolution is always via another admin or Microsoft support (Data Protection team). There is no self-service bypass for a sole admin with all MFA methods unavailable.

After Microsoft resets MFA and access is restored, it is recommended to:

• Configure multiple MFA methods (Authenticator, SMS/voice, possibly another device) so that a single device loss does not cause lockout.
• Ensure there is at least one additional Global Administrator to perform MFA resets if needed.

References:

• You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
• Can't use Azure Multi-Factor Authentication to sign in to cloud services after you lose your phone or the phone number changes
• Preventing tenant lockouts
• Common problems with two-step verification for a work or school account
• Use a screen reader to set up and troubleshoot multifactor authentication
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• Global Admin Locked out - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A
• Microsoft authenticator sending me into a spiral - Microsoft Q&A
• Azure has blocked myphone number for SMS verification due to a “bad reputation” flag - Microsoft Q&A
• Microsoft Curate - Troubleshoot Multi-Factor Authentication (MFA)