Applies to: Microsoft 365 Business plans, Microsoft Entra ID, the Microsoft 365 admin center
Every so often a friend or former colleague who runs a small business comes to me with the same problem, and it has no good answer once it happens. They’re the only Microsoft 365 admin. Their SMS codes, email codes and authenticator app codes have all stopped working. There’s no IT department to call.
Microsoft gives you three ways back in, and all three look fine on paper. But if you run a 10 to 50 person business with one admin, two of them need something you set up before the bad day. Most owners never did. The third works with no setup at all, and it’s the slowest, while email, Teams and billing sit unmanaged.
I’ll walk through the three options, how each one works, and the rules I’d use to pick. After that comes the 30 minutes of setup that keeps you from ever needing this page again.
Why this happens more often now
Microsoft now requires MFA to sign in to its admin portals. Starting in October 2024, it began requiring MFA for the Azure portal and the Microsoft Entra admin center. Starting in February 2025, the same enforcement began rolling out to the Microsoft 365 admin center.
That’s a good change. But it means an owner with one phone and one authenticator app now has one point of failure. Lose the phone, and the admin center is closed to you. Picking Stay signed in doesn’t help either. Microsoft says you still have to complete MFA.
Most people’s first move is to reset the password. But the password still works. What you lost is the second factor, and a new password doesn’t bring it back.
Option 1: Self-service password reset
Self-service password reset (SSPR) is the Can’t access your account? link on the sign-in page. People try it first because it’s right there, and it needs nobody else.
For admins, Microsoft runs a stricter version. In my test tenant, the Administrator Policy page shows it’s on and needs two methods:
Entra ID > Password reset > Administrator Policy
Admin password reset is on and needs two methods. You can't change this policy, and security questions aren't allowed.
How it works in practice
Go to aka.ms/sspr, enter your admin address, and prove who you are with two of the methods on that list. Microsoft’s policy page calls this the “two-gate” policy, and it applies to Global Administrator and dozens of other admin roles. If both gates pass, you pick a new password.
One oddity: Microsoft’s own pages disagree on whether admin SSPR is on by default. The policy page says it is. Another Microsoft page says it isn’t. My admin center said “Admins are always enabled.” Check yours before you rely on it.
Pros:
- No one else needed: It works at 2 AM on a Sunday with nobody to call.
- Free and already there: It’s part of Microsoft Entra ID, so there’s nothing to buy.
Cons and hidden traps:
- It resets passwords, not MFA: If your phone is gone, you still face the MFA prompt after the reset.
- Both gates often live on the same phone: SMS and the authenticator app on one lost phone means zero working gates.
- Authenticator counts once: Microsoft counts the Authenticator app and any code app as a single method, so two apps on one phone don’t give you two gates.
Option 2: Another admin resets your MFA
If anyone else in your tenant holds an admin role, they can wipe your lost methods and let you set up new ones. This is how big organizations handle it every day. It’s also why Microsoft keeps telling you not to have only one admin.
Entra ID > Users > user > Authentication methods
The other admin selects Require re-register multifactor authentication on your account. Your next sign-in asks you to set up MFA again.
How it works in practice
The other admin signs in to the Microsoft Entra admin center, goes to Entra ID > Users, opens your account and selects Authentication methods. From there they have two choices:
- Require re-register multifactor authentication. This clears your old phone and app. You sign in with your password and set up MFA again on the new phone.
- Add authentication method > Temporary Access Pass. This gives you a short code that works in place of MFA. Microsoft’s default is 1 hour, and the policy allows up to 30 days. You sign in with it and register a new phone or a passkey.
Before a Temporary Access Pass works, it has to be turned on in Authentication methods > Policies. In my tenant, it wasn’t:
Entra ID > Authentication methods > Policies
Passkey (FIDO2) and Temporary Access Pass both read No here. Turn them on before the day you need them.
Pros:
- Fast: It takes minutes once the other admin is at a keyboard.
- Clean: You end up with fresh methods, and the lost phone can’t be used to sign in as you.
Cons and hidden traps:
- The second admin needs real rights: Microsoft’s Temporary Access Pass page says an Authentication Administrator can only issue passes to non-admins. For an admin, they need Privileged Authentication Administrator or Global Administrator.
- It has to exist before the lockout: You can’t create a second admin while you’re locked out. That’s the whole problem.
Option 3: Microsoft support recovery
When you’re the only admin and Options 1 and 2 are gone, Microsoft support is what’s left. They verify that you own the tenant, then reset MFA on your account.
Microsoft’s support page for admins says technical support runs in English 24 hours a day, 7 days a week. The usual route, Help & support in the admin center, needs you to be signed in, so you’ll be calling. Tell the agent you’re the only Global Administrator and you’re locked out by MFA. Have your domain, your billing details and your business documents ready.
Pros:
- Always there: It works even when you set up nothing in advance.
- Included: Support comes with a subscription you bought from Microsoft.
Cons and hidden traps:
- Slowest of the three: You’re proving ownership to a stranger, and that takes calls, documents and waiting.
- Your business sits unmanaged: No new users, no licence changes and no fixes until it’s done.
Side-by-side comparison
Here’s how the three options compare on the things that matter at 9 AM on a Monday with no admin access:
| Self-service password reset | Second admin resets MFA | Microsoft support | |
|---|---|---|---|
| Needs setup beforehand | Two methods that aren’t on one phone | A second admin account | Nothing |
| Fixes a lost MFA phone | Rarely | Yes | Yes |
| Time to get back in | Minutes | Minutes | Slowest of the three |
| Who does the work | You | Another admin | Microsoft, with your proof |
| Main risk | Both gates on the lost phone | Second admin has too few rights | Support code goes to the lost phone |
The consultant’s verdict
Pick by what you still have. These are the rules I’d use:
- Choose password reset if you forgot your password but still have your phone, or you have two methods on two different devices.
- Choose a second admin if anyone else holds Global Administrator or Privileged Authentication Administrator. Call them first. It’s the fastest real fix for a lost phone.
- Choose Microsoft support if you’re the only admin and your methods are gone. Call today. Nobody can add users or fix licences until it’s sorted.
Then, once you’re back in, do the next two sections the same day.
A 10-minute check you can do today
If you can still sign in, you’re in the best spot to fix this. Run through these four checks while it’s quiet:
- Count your admins. In the Entra admin center, open Roles & admins and select Global Administrator. If you see one name, yours, that’s the problem this post is about.
- Open the Administrator Policy page. Go to Password reset > Administrator Policy and confirm it says Yes and shows how many methods it needs.
- Look at your own methods. Go to Security info. If every method lives on one phone, add one that doesn’t.
- Check your admin profile contact details. This is where Microsoft support sends its PIN. Make sure it’s an email and a phone you’d still have on a bad day.
None of these change anything for your staff. They just tell you how exposed you are.
Set it up so this can’t happen again
Microsoft’s fix is the emergency access account, often called a break-glass account. You never use it day to day. It waits for the morning your normal sign-in fails.
Older advice said to exclude it from MFA. That’s out of date. Mandatory MFA applies to break-glass accounts too, so Microsoft now says to give them a passkey (FIDO2) instead. Here’s the setup, from Microsoft’s page:
- Create at least two accounts, cloud-only, on your
.onmicrosoft.comdomain, not your custom domain. - Assign Global Administrator to each, as a permanent active role, not one that needs activating.
- Turn on Passkey (FIDO2) in Authentication methods > Policies, then register a hardware security key on each account. Use a different method from your daily admin account.
- Exclude both accounts from any Conditional Access policy that blocks or restricts sign-in.
- Store the keys and passwords in separate secure places, like a safe at the office and one at home.
- Test both accounts at least every 90 days, and after anyone with access leaves.
Then fix your own account. Microsoft recommends that users register two or more methods. Add a second method that doesn’t live on your phone, like a security key or a work email you can reach from any computer.
What this does not fix
A break-glass account protects you from losing a phone. It doesn’t protect you from everything:
- A compromised account. If someone stole your password and MFA, the right move is to lock them out, not to sign in faster. That’s a security incident, not a lost phone.
- Federated sign-in outages. If your users sign in through another identity provider, that’s a separate design question.
- Keys nobody can find. A security key in a drawer nobody remembers is the same as no key. The 90-day test is what catches this.
- Partner-only tenants. If a partner bought and runs your subscriptions, your recovery path goes through them. Ask them how it works before you need it.
Need a second set of eyes on your admin setup?
Setting up two break-glass accounts and a second MFA method takes about 30 minutes if you’ve done it before. The first time, the hard part is knowing which Conditional Access policies to exclude and testing the accounts without locking yourself out.
- Want it done or checked once? An hour bank starts at $140 CAD per hour, in banks of 5, 10 or 25 hours, with no expiry.
- Not sure where to start? Send me a note with what you have today, and I’ll tell you what’s missing.