How do I get back into a Microsoft 365 tenant when the admin MFA is gone?

Start with any Microsoft partner or cloud provider that already has delegated access to the tenant. If there is an active relationship with delegated admin permissions, they may be able to help restore access or advise on the right escalation path.

If no such partner can help, open a Microsoft support case and explain plainly that the tenant’s sole administrator is inaccessible because MFA is unavailable. Be ready to establish that your organization owns the domain and tenant. Support may also ask for company identity, billing or subscription records, and older account details. Keep the evidence together so you can respond quickly.

Use the official tenant recovery process. Domain control is useful evidence, but it may not be enough by itself, so gather whatever connects the organization to the tenant: billing records, subscription information, company documents, and details about the former administrator account.

Expect identity checks and a potentially slow process. If you have a Microsoft account team or paid support arrangement, ask them to help route or escalate the case. Avoid repeatedly attempting access through the old account while recovery is underway.

First check whether another administrator, a partner, or a cloud provider still has authorized delegated access. If none does, support is the practical path. Make the case clear about the scope: whether this is one administrator account or a tenant-wide lockout affecting many users. For a broad lockout, say that explicitly and request the appropriate urgent escalation. The support route and response time can vary, so keep the case active and document each update.

For a policy-caused lockout, treat it as a different problem from a lost MFA device. Contact support and clearly describe the conditional access change, the affected accounts, and the impact. Ask for the case to reach the team that handles tenant access and data protection issues, and state the business impact when requesting urgency.

After access is restored, review emergency administrator accounts and test policy changes carefully. Exclusions should be verified, not just assumed, and policy testing or staged rollout can reduce the chance of locking out every admin at once.