Locked out as admin from my business account

Hi @Joe Bester,

Good day, and I appreciate the clear description of your issue.

Error code 399287 normally indicates an MFA verification failure caused by an inconsistent or incomplete Microsoft Authenticator registration. This can occur when the authentication challenge cannot be finalized because the Authenticator app on the device no longer matches the MFA configuration stored in Microsoft Entra ID, such as after the app is deleted or reinstalled. As a result, the sign-in process enters a verification loop and the account cannot be validated successfully, even though the correct credentials are used.

To move toward a resolution, I suggest the following options:

Option 1: Contact Microsoft Data Protection Support by phone (Primary Method)

(Please proceed with the second option if contacting phone support is not applicable to the situation)

To regain access to your admin account as you can't access the Admin Portal, you can try reaching out to our Global Customer Service phone to raise a request for resetting your authentication method here: Customer service phone numbers - Microsoft Support. During the call, request to speak to an agent, and share with them every detail related to your query and also mention that you are the only admin lost access to your account. This should allow you to contact the appropriate team so you can solve this incident as soon as possible.

Here are some tips and an example of a prompt to help you navigate the IVR more effectively:

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)

In some countries, it is an automated conversation like:

IVR: What kind of problem are you concerned about?

You: Authenticator.

IVR: What kind of product do you use?

You: Office 365 for business.

IVR confirmation: education or company account?

You: For companies

IVR: Are you an administrator?

You: Yes.

IVR: Do you have another administrator in your organization?

You: No.

You: Yes. I need to create a ticket. Please send me directly to the Data Protection Team.

Please note that forum moderators do not have access to user account settings and cannot assist with logging in, resetting passwords, or changing access rights. While we do not have access to internal systems or administrative tools required to resolve account-specific or backend-related issues, we’ll continue doing our best to support you within the scope of our responsibilities.

Option 2: Create a new tenant to submit a support ticket (Alternative method)

If you still cannot reach to a live agent, there is still a workaround, you might consider registering for a new tenant by signing up for a trial subscription via this link: Microsoft 365 Business Plans and Pricing | Microsoft 365. (please select "Try for free" under a business subscription and click Next).

When prompted, enter your email. You can use your personal email or create a new Microsoft personal account for this step.

Then select Set up account to move forward.

From this step, the system should guide you through creating your tenant and assign you a default onmicrosoft.com domain.

Once set up, you can access the admin console of the trial tenant using the onmicrosoft account and submit a support ticket requesting to speak with the Data Protection team on behalf of your previous tenant.

To create a support ticket (you can also start here if you've already had another tenant): In the Microsoft 365 admin center > Help & Support.

In your ticket description, you'll need to clearly explain that you're trying to regain access to your previous Microsoft 365 tenant and need help from the Data Protection team. Here's a message you can use or adapt:

"Hello, I’m unable to access my previous Microsoft 365 tenant and I'm the only admin.

I created this new tenant solely to request assistance. I kindly ask to be connected with the Data Protection team to verify my identity and help me recover access to the original tenant.

This is urgent, as I rely on Microsoft 365 for my work and have been unable to operate for several days. I’m available to provide any documentation or verification needed to support the recovery process."

It is important to note:

• Please remember to cancel turn off recurring billing for the trial subscription once your issue is resolved to avoid any unintended charges. You may prefer the following resource for detailed instructions: Cancel your Microsoft business subscription in the Microsoft 365 admin center | Microsoft Learn.
• During the initial setup of the trial tenant, please ensure MFA is configured and not skipped, as skipping this step may result in access issues or restricted recovery options later.

I hope this helps you regain access to your account quickly. I'm glad to assist and truly hope the information provided has been useful. Please feel free to reach out anytime if you need further assistance.

If you find my post useful, kindly consider upvoting it. Doing so can assist others in the community who may have similar questions in finding solutions more quickly.

Thank you for your kindness and contributions to the forum.

If the answer is helpful, please click "Accept Answer". If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in this documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

pls can you give me the following numbers - Call Microsoft using the regional Customer service phone numbers and have frontline support open a ticket to the Data Protection team for an admin MFA reset/tenant recovery.

Because the sign-in is blocked at multifactor authentication and the account is the only admin on a Microsoft 365 business tenant, this is a tenant lockout scenario that must be handled by Microsoft support (Data Protection team). Self-service fixes are not available when the only registered MFA method is unavailable or failing.

Use these steps depending on whether there is any other global admin:

1. If there is another global admin in the tenant
   • That admin signs in to the Azure portal and opens Microsoft Entra ID.
   • Go to Users → select the locked-out admin account.
   • Open Authentication methods and select Require re-register multifactor authentication.
   • After this, sign-in will prompt to set up MFA again and a fresh registration with Microsoft Authenticator can be completed.
2. If there is no other global admin (sole admin scenario)
   • This requires Microsoft’s Data Protection / Tenant Recovery process.
   • Call Microsoft using the regional Customer service phone numbers and have frontline support open a ticket to the Data Protection team for an admin MFA reset/tenant recovery.
   • When navigating the IVR, clearly state that this is an Office 365 for business account, that it is a company account, that the caller is the only administrator, and that an MFA reset / tenant admin recovery is needed.
   • If reaching a live agent is difficult, one workaround is to create a new, temporary Microsoft 365 trial tenant, sign in to its Microsoft 365 Admin Center, and from Help & support open a ticket requesting the Data Protection team to reset MFA for the original locked tenant. After resolution, cancel the trial to avoid charges.

The Data Protection team will verify identity and ownership of the tenant and then can clear or reset the MFA registration so that sign-in to the original business account can be completed and new authentication methods can be configured.

References:

• Common problems with two-step verification for a work or school account
• Reset your Microsoft work or school account password using security info
• I cant log in to my business account because it is requiring Authenticator app which I do not have - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• Global Admin Locked out - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A