URGENT: Sole admin MFA lockout (Case 2603291420000313)

Question

URGENT: Sole admin MFA lockout (Case 2603291420000313)

Rui Mamede 0

Hi,

I'm locked out of my account, probably because I failed to provide alternative sign-on validation methods (e.g., phone number, alternative email address, etc.).

Everytime I try to log into the account I created when I subscribed to a PowerBI Pro license I can't because (after entering both my username and password) the login system keeps asking me to validate the session using the Microsoft Authenticator app - on which I'm unable to log into for the exact same reason - it always asks to validate a number in Authenticator, even if trying to sign-on from within Microsoft Authenticator app itself.

Please assist.

Regards,

Rui

Raja Pothuraju 47,080 Reputation points Microsoft External Staff Moderator

2026-03-30T10:14:57.2633333+00:00

Hello @Rui Mamede,

I have reviewed your support ticket, and I see the status as Mitigated. Please let me know if you are still having the problem at the time of login.
Rui Mamede 0 Reputation points

2026-03-30T11:10:20.6233333+00:00

Actually, I believe there still is a problem. After we added an alternative sign-in method in https://mysignins.microsoft.com/security-info during our call (in this case, an email address) I tried logging into my account through admin.microsoft.com (as previously instructed). However, after inputing both the account name and password (as requested), the login system again prompts me to complete the sign-in process in Authenticator; if I click on the "At this time I cannot use my Microsoft Authenticator app" link, it shows the exact same thing it did before:

As you can see, no option to complete the identity confirmation through email is given.

Also, when browsing through Microsoft Entra Admin Center it becomes cleat that MFA is not even enabled for this account, so I don't even understand why the login can't be performed on the basis of username+password alone:

Also, when trying to add a phone number as a recovery alternative, I always stumble upon this error:

Please assist.

Thank you.
Raja Pothuraju 47,080 Reputation points Microsoft External Staff Moderator

2026-04-06T11:44:09.9333333+00:00

@Rui Mamede, Let's take this offline, please share your email address and available for a call over private message.

2 answers

Your answer

Raja Pothuraju 47,080 Reputation points Microsoft External Staff Moderator

2026-03-30T10:14:57.2633333+00:00

Hello @Rui Mamede,

I have reviewed your support ticket, and I see the status as Mitigated. Please let me know if you are still having the problem at the time of login.
Rui Mamede 0 Reputation points

2026-03-30T11:10:20.6233333+00:00

Actually, I believe there still is a problem. After we added an alternative sign-in method in https://mysignins.microsoft.com/security-info during our call (in this case, an email address) I tried logging into my account through admin.microsoft.com (as previously instructed). However, after inputing both the account name and password (as requested), the login system again prompts me to complete the sign-in process in Authenticator; if I click on the "At this time I cannot use my Microsoft Authenticator app" link, it shows the exact same thing it did before:

As you can see, no option to complete the identity confirmation through email is given.

Also, when browsing through Microsoft Entra Admin Center it becomes cleat that MFA is not even enabled for this account, so I don't even understand why the login can't be performed on the basis of username+password alone:

Also, when trying to add a phone number as a recovery alternative, I always stumble upon this error:

Please assist.

Thank you.
Raja Pothuraju 47,080 Reputation points Microsoft External Staff Moderator

2026-04-06T11:44:09.9333333+00:00

@Rui Mamede, Let's take this offline, please share your email address and available for a call over private message.

Answer 1

Hello @Rui Mamede,

Thank you for connecting over team's call.

I’ve reached out to the engineering team regarding the MFA issue on your account. They have now unblocked it from the backend and cleared the bad reputation associated with it. You should be able to log in to the Azure Portal without any issues.

Please try signing in and verify if you can complete SMS authentication successfully. Let me know if you encounter any problems.

For better practice, I recommend using with Microsoft Authenticator method to your account instead of SMS method as these SMS/Voice telecom auth methods are susceptible to IRSF attacks telephony fraud.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

Answer 2

Because the account is protected by Microsoft Entra multifactor authentication (MFA) and there is no working alternative sign-in method, this is a tenant lockout scenario for a sole administrator. Self-service recovery is not possible; recovery must go through an administrator or Microsoft support.

Use the following paths based on the situation:

If there is any other admin in the tenant
- Ask that admin to reset MFA for the locked-out account in Microsoft Entra ID:
  1. Sign in to the Microsoft Entra admin center.
  2. Go to Users → All users and select the locked-out account.
  3. Open Authentication methods.
  4. Select Require re-register multifactor authentication.
  5. Sign in again on the affected account and complete MFA registration (Authenticator, phone, etc.).
If this account is the only admin (sole global admin)
- This is the case described in the referenced Q&A threads. The only supported path is escalation to the Microsoft Data Protection / Tenant Recovery team via support:
Option A – Call Microsoft support (recommended)
- Call the regional Customer service phone numbers - Microsoft Support line.
- When interacting with the IVR/agent, clearly state:
  - The issue is Authenticator / MFA lockout.
  - The product is Office 365 / Microsoft 365 for business (Power BI Pro is under this tenant).
  - It is a company account, not education.
  - Confirm being the only administrator and that no other admin can reset MFA.
  - Request creation of a service request with the Data Protection team to reset MFA / recover the tenant.
- Be prepared to provide tenant and admin details and proof of ownership as requested.
Option B – Create a temporary trial tenant to open a ticket (fallback)
- If reaching a live agent is difficult, create a new temporary Microsoft 365/Office 365 trial tenant.
- Sign in to the new tenant’s Microsoft 365 admin center and go to Support → Help & support.
- Open a ticket explaining:
  - The ticket is about a different, existing tenant where the admin is locked out by MFA.
  - Provide the locked tenant’s domain, the admin UPN, error behavior, and that there is no other global admin.
- Ask support to route the case to the Data Protection team for tenant admin MFA reset.
While blocked by MFA prompts
- Do not keep making repeated sign-in attempts, as high volumes and unusual activity can trigger or extend blocks. If a temporary block is suspected, wait before retrying and use a different verification method or network only if available.

Until Microsoft support (Data Protection / Tenant Recovery) verifies identity and resets MFA registration, access to the tenant and Power BI Pro admin functions cannot be restored.

References:

Share via

URGENT: Sole admin MFA lockout (Case 2603291420000313)

2 answers

Your answer