How am I supposed to get access to my tenant again?

Dear @Eric Henriksson,

Thank you for posting your question in the Microsoft Q&A forum.

Based on your description, the issue occurs because Azure uses a separate MFA configuration from your personal Microsoft account, and the Authenticator code you are entering does not match the MFA method registered in your tenant.

If you are the only Global Administrator, this is considered a tenant lockout scenario, and there is no self-service way to reset MFA. You must contact Microsoft Support and request escalation to the Data Protection team, who will verify your ownership and reset your MFA configuration.

You might try to contact Microsoft Support team via phone service number: Customer service phone numbers - Microsoft Support.

To help you navigate the automated phone system (IVR), here's an example of what the conversation might look like:

IVR: What kind of problem are you worried about?

You: Admin account locked

IVR: What kind of product do you use?

You: Office 365 for business

IVR: Does it count for education or business?

You: For Business

IVR: Are you an admin?

You: Yes

IVR: Do you have another administrator in your organization?

You: No

IVR: Need a service request?

You: Yes

This should help you connect with a live support agent who can help you directly.

If you can't create a support ticket during the call, I recommend creating a temporary tenant account and submitting the support request from there. To create a new tenant, follow these steps:

1. Visit Office 365 E3 - Enterprise Collaboration and Productivity | Microsoft    
2. Select any plan and click Try for free.    
3. Complete the setup to create a new tenant.    
4. Ticket support: In the Microsoft 365 admin center>support>help & support. You can create a support ticket: https://admin.microsoft.com/#/support/requests     

Important: Please remember to cancel the trial subscription once your issue is resolved to avoid any charges.    

I hope my information can help you resolve the issue, feel free to reach out if you have any other questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

For a personal Microsoft account that’s locked out of Azure because of MFA, and where the current Authenticator codes are “not expected,” the MFA registration for the Azure tenant is effectively stuck and must be reset from the tenant side. Because sign-in to the Azure portal is blocked and there’s no support plan, the only viable paths are:

1. Have another admin reset MFA (if any exist)
   If the personal account is a guest or member in a tenant that has another Global Administrator:
   1. That Global Admin signs in to the Microsoft Entra admin center.
   2. Goes to Identity → Users → All users.
   3. Selects the affected user.
   4. Opens Authentication methods.
   5. Selects Require re-register multifactor authentication.
      After this, the next sign-in for the affected account will prompt to set up MFA again with a fresh registration.
2. If there is no other Global Admin: involve Microsoft Data Protection via support
   When the locked-out user is the only admin and cannot reach the Azure/M365 admin portals to open a ticket, the case must be handled by Microsoft’s Data Protection/Tenant Recovery team. The documented options are: Option A – Call Microsoft global customer service
   Use the published Customer service phone numbers for Microsoft Support and, through the IVR, request a service request for an Authenticator/MFA lockout on a business/tenant account where there is only one admin. The Data Protection team then verifies identity and ownership and can reset the admin’s authentication methods so that MFA can be re-registered. Option B – Create a temporary trial tenant to open a ticket
   If reaching a live agent is difficult, create a new, separate Microsoft 365/Azure trial tenant and use it only as a channel to contact support:
   1. Sign up for a Microsoft 365 or Azure trial to create a new tenant and Global Admin.
   2. Go to the new tenant’s admin center (for Microsoft 365: https://admin.microsoft.com).
   3. Use Support → Help & support to open a support request.
   4. In the ticket, clearly state that the problem is with a different, existing tenant where the only Global Admin is locked out due to MFA, and provide:
      • The locked tenant’s domain name.
      • The admin username for the locked tenant.
      • Error behavior (MFA code “wasn’t expected”, cannot access portal, etc.).
      • Confirmation that there is no other Global Admin.
   5. Ask to be routed to the Data Protection / Tenant Recovery team to reset MFA for the locked admin account.
      After recovery, cancel the trial subscription on the temporary tenant to avoid charges.
3. If the account is a guest in another tenant
   If the personal Microsoft account is a guest in a separate Azure AD/Microsoft Entra tenant (for example, a partner or another organization’s tenant), the owner of that tenant must perform the MFA reset for the guest account as in step 1 above.
4. CLI access does not replace tenant-level MFA reset
   Being able to sign in via Azure CLI without MFA does not allow self-reset of tenant MFA or opening a Data Protection ticket. Tenant-level MFA registration for the admin must be reset by:
   • Another Global Admin in that tenant, or
   • Microsoft Support (Data Protection) after identity verification, using the phone or trial-tenant route described above.

These are the supported paths to regain access when an Azure tenant’s only admin is locked out by MFA and cannot reach the portal or standard support entry points.

References:

• Reset Personal Azure MFA - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• Global Admin Locked out - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A