# Locked out as the only Microsoft 365 admin: 3 ways back in

> Lost your MFA phone and you're the only Microsoft 365 admin? Compare password reset, a second admin and Microsoft support, then add a break-glass account.

[Home](https://tenantcraft.ca/)  [Insights](https://tenantcraft.ca/insights)  Governance

Govern Oct 14, 2026  9 min read

## Locked out as your only Microsoft 365 admin: how to get back in

Your phone is gone, your MFA codes stopped working, and you're the only admin. There are three ways back in: password reset, a second admin, or Microsoft support. Only one of them works if you never set anything up, and it's the slowest.

Geri Crroj

Microsoft 365 consultant, Niagara, Ontario

Tested in a live tenant, October 14, 2026

**Applies to:** Microsoft 365 Business plans, Microsoft Entra ID, the Microsoft 365 admin center

Every so often a friend or former colleague who runs a small business comes to me with the same problem, and it has no good answer once it happens. They’re the only Microsoft 365 admin. Their SMS codes, email codes and authenticator app codes have all stopped working. There’s no IT department to call.

Microsoft gives you three ways back in, and all three look fine on paper. But if you run a 10 to 50 person business with one admin, two of them need something you set up before the bad day. Most owners never did. The third works with no setup at all, and it’s the slowest, while email, Teams and billing sit unmanaged.

I’ll walk through the three options, how each one works, and the rules I’d use to pick. After that comes the 30 minutes of setup that keeps you from ever needing this page again.

TL;DR for busy admins

-   **Try self-service password reset first** if you still have two working sign-in methods, like a work email and a second phone.
-   **Ask a second admin to reset your MFA** if one exists. It takes minutes, and they can give you a **Temporary Access Pass** to sign in with.
-   **Call Microsoft support** only when you’re the sole admin and both other options are gone. It’s the slowest path.
-   **Set up two break-glass accounts with passkeys this week.** Microsoft’s mandatory MFA applies to them too, so “exclude it from MFA” is no longer the advice.

## Why this happens more often now

Microsoft now requires MFA to sign in to its admin portals. Starting in **October 2024**, it began requiring MFA for the Azure portal and the Microsoft Entra admin center. Starting in **February 2025**, the [same enforcement](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication) began rolling out to the Microsoft 365 admin center.

That’s a good change. But it means an owner with one phone and one authenticator app now has one point of failure. Lose the phone, and the admin center is closed to you. Picking **Stay signed in** doesn’t help either. Microsoft says you still have to complete MFA.

Most people’s first move is to reset the password. But the password still works. What you lost is the second factor, and a new password doesn’t bring it back.

## Option 1: Self-service password reset

Self-service password reset (SSPR) is the **Can’t access your account?** link on the sign-in page. People try it first because it’s right there, and it needs nobody else.

For admins, Microsoft runs a stricter version. In my test tenant, the **Administrator Policy** page shows it’s on and needs two methods:

![The Microsoft Entra admin center showing Password reset, Administrator Policy. Is self-service password reset enabled reads Yes. Number of methods required to reset reads 2. Methods available to administrators lists Email, Mobile phone (SMS only), Mobile phone, Office phone, Mobile app code and Mobile app notification.](https://tenantcraft.ca/images/lock-01-admin-sspr-policy.png)

Entra ID > Password reset > Administrator Policy

Admin password reset is on and needs two methods. You can't change this policy, and security questions aren't allowed.

### How it works in practice

Go to [aka.ms/sspr](https://aka.ms/sspr), enter your admin address, and prove who you are with two of the methods on that list. Microsoft’s [policy page](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-policy) calls this the “two-gate” policy, and it applies to Global Administrator and dozens of other admin roles. If both gates pass, you pick a new password.

One oddity: Microsoft’s own pages disagree on whether admin SSPR is on by default. The policy page says it is. Another [Microsoft page](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-howitworks) says it isn’t. My admin center said “Admins are always enabled.” Check yours before you rely on it.

### Pros:

-   **No one else needed:** It works at 2 AM on a Sunday with nobody to call.
-   **Free and already there:** It’s part of Microsoft Entra ID, so there’s nothing to buy.

### Cons and hidden traps:

-   **It resets passwords, not MFA:** If your phone is gone, you still face the MFA prompt after the reset.
-   **Both gates often live on the same phone:** SMS and the authenticator app on one lost phone means zero working gates.
-   **Authenticator counts once:** Microsoft counts the Authenticator app and any code app as a single method, so two apps on one phone don’t give you two gates.

## Option 2: Another admin resets your MFA

If anyone else in your tenant holds an admin role, they can wipe your lost methods and let you set up new ones. This is how big organizations handle it every day. It’s also why Microsoft keeps telling you not to have only one admin.

![A user's Authentication methods page in the Microsoft Entra admin center. The command bar shows Add authentication method, Reset password, Require re-register multifactor authentication, Revoke sessions and View authentication methods policy. Require re-register multifactor authentication is ringed.](https://tenantcraft.ca/images/lock-02-require-reregister-mfa.png)

Entra ID > Users > user > Authentication methods

The other admin selects Require re-register multifactor authentication on your account. Your next sign-in asks you to set up MFA again.

### How it works in practice

The other admin signs in to the [Microsoft Entra admin center](https://entra.microsoft.com), goes to **Entra ID** > **Users**, opens your account and selects **Authentication methods**. From there they have two choices:

1.  **Require re-register multifactor authentication.** This clears your old phone and app. You sign in with your password and set up MFA again on the new phone.
2.  **Add authentication method** > **Temporary Access Pass.** This gives you a short code that works in place of MFA. Microsoft’s default is **1 hour**, and the policy allows up to **30 days**. You sign in with it and register a new phone or a passkey.

Before a Temporary Access Pass works, it has to be turned on in **Authentication methods** > **Policies**. In my tenant, it wasn’t:

![The Authentication method policies list in the Microsoft Entra admin center. Passkey (FIDO2) shows Enabled No and Temporary Access Pass shows Enabled No, both ringed. Email OTP is the only method showing Yes.](https://tenantcraft.ca/images/lock-03-auth-method-policies.png)

Entra ID > Authentication methods > Policies

Passkey (FIDO2) and Temporary Access Pass both read No here. Turn them on before the day you need them.

### Pros:

-   **Fast:** It takes minutes once the other admin is at a keyboard.
-   **Clean:** You end up with fresh methods, and the lost phone can’t be used to sign in as you.

### Cons and hidden traps:

-   **The second admin needs real rights:** Microsoft’s [Temporary Access Pass page](https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-pass) says an Authentication Administrator can only issue passes to non-admins. For an admin, they need Privileged Authentication Administrator or Global Administrator.
-   **It has to exist before the lockout:** You can’t create a second admin while you’re locked out. That’s the whole problem.

## Option 3: Microsoft support recovery

When you’re the only admin and Options 1 and 2 are gone, Microsoft support is what’s left. They verify that you own the tenant, then reset MFA on your account.

Microsoft’s [support page for admins](https://learn.microsoft.com/en-us/microsoft-365/admin/get-help-support) says technical support runs in English **24 hours a day, 7 days a week**. The usual route, **Help & support** in the admin center, needs you to be signed in, so you’ll be calling. Tell the agent you’re the only Global Administrator and you’re locked out by MFA. Have your domain, your billing details and your business documents ready.

Field note: check where support sends its code

Microsoft added a PIN step to phone support. If you call from a number that isn’t on your organization’s profile, the agent sends a code to the email or phone registered in your Microsoft 365 admin center profile. If that’s the phone you just lost, or a mailbox you can’t open, you’re stuck again. And if you bought every subscription through a partner, Microsoft’s page tells you to go to that partner for support instead. Check both today, while you can still sign in.

### Pros:

-   **Always there:** It works even when you set up nothing in advance.
-   **Included:** Support comes with a subscription you bought from Microsoft.

### Cons and hidden traps:

-   **Slowest of the three:** You’re proving ownership to a stranger, and that takes calls, documents and waiting.
-   **Your business sits unmanaged:** No new users, no licence changes and no fixes until it’s done.

## Side-by-side comparison

Here’s how the three options compare on the things that matter at 9 AM on a Monday with no admin access:

|  | Self-service password reset | Second admin resets MFA | Microsoft support |
| --- | --- | --- | --- |
| **Needs setup beforehand** | Two methods that aren’t on one phone | A second admin account | Nothing |
| **Fixes a lost MFA phone** | Rarely | Yes | Yes |
| **Time to get back in** | Minutes | Minutes | Slowest of the three |
| **Who does the work** | You | Another admin | Microsoft, with your proof |
| **Main risk** | Both gates on the lost phone | Second admin has too few rights | Support code goes to the lost phone |

## The consultant’s verdict

Pick by what you still have. These are the rules I’d use:

-   **Choose password reset if** you forgot your password but still have your phone, or you have two methods on two different devices.
-   **Choose a second admin if** anyone else holds Global Administrator or Privileged Authentication Administrator. Call them first. It’s the fastest real fix for a lost phone.
-   **Choose Microsoft support if** you’re the only admin and your methods are gone. Call today. Nobody can add users or fix licences until it’s sorted.

Then, once you’re back in, do the next two sections the same day.

## A 10-minute check you can do today

If you can still sign in, you’re in the best spot to fix this. Run through these four checks while it’s quiet:

1.  **Count your admins.** In the Entra admin center, open **Roles & admins** and select **Global Administrator**. If you see one name, yours, that’s the problem this post is about.
2.  **Open the Administrator Policy page.** Go to **Password reset** > **Administrator Policy** and confirm it says **Yes** and shows how many methods it needs.
3.  **Look at your own methods.** Go to [Security info](https://mysignins.microsoft.com/security-info). If every method lives on one phone, add one that doesn’t.
4.  **Check your admin profile contact details.** This is where Microsoft support sends its PIN. Make sure it’s an email and a phone you’d still have on a bad day.

None of these change anything for your staff. They just tell you how exposed you are.

## Set it up so this can’t happen again

Microsoft’s fix is the [emergency access account](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access), often called a break-glass account. You never use it day to day. It waits for the morning your normal sign-in fails.

Older advice said to exclude it from MFA. That’s out of date. Mandatory MFA applies to break-glass accounts too, so Microsoft now says to give them a passkey (FIDO2) instead. Here’s the setup, from Microsoft’s page:

1.  **Create at least two accounts**, cloud-only, on your `.onmicrosoft.com` domain, not your custom domain.
2.  **Assign Global Administrator** to each, as a permanent active role, not one that needs activating.
3.  **Turn on Passkey (FIDO2)** in **Authentication methods** > **Policies**, then register a hardware security key on each account. Use a different method from your daily admin account.
4.  **Exclude both accounts** from any Conditional Access policy that blocks or restricts sign-in.
5.  **Store the keys and passwords in separate secure places**, like a safe at the office and one at home.
6.  **Test both accounts at least every 90 days**, and after anyone with access leaves.

Then fix your own account. Microsoft [recommends](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-howitworks) that users register two or more methods. Add a second method that doesn’t live on your phone, like a security key or a work email you can reach from any computer.

## What this does not fix

A break-glass account protects you from losing a phone. It doesn’t protect you from everything:

-   **A compromised account.** If someone stole your password and MFA, the right move is to lock them out, not to sign in faster. That’s a security incident, not a lost phone.
-   **Federated sign-in outages.** If your users sign in through another identity provider, that’s a separate design question.
-   **Keys nobody can find.** A security key in a drawer nobody remembers is the same as no key. The 90-day test is what catches this.
-   **Partner-only tenants.** If a partner bought and runs your subscriptions, your recovery path goes through them. Ask them how it works before you need it.

## Need a second set of eyes on your admin setup?

Setting up two break-glass accounts and a second MFA method takes about 30 minutes if you’ve done it before. The first time, the hard part is knowing which Conditional Access policies to exclude and testing the accounts without locking yourself out.

-   **Want it done or checked once?** An [hour bank](https://tenantcraft.ca/pricing) starts at $140 CAD per hour, in banks of 5, 10 or 25 hours, with no expiry.
-   **Not sure where to start?** [Send me a note](https://tenantcraft.ca/contact) with what you have today, and I’ll tell you what’s missing.

Admin access is the first thing to check before any governance or Copilot work.

Copilot Readiness Governance Checklist

PDF · 7 pages · 44 checkpoints

[Email me the PDF](https://tenantcraft.ca/resources/guides/copilot-readiness-governance)

TWENTY MINUTES

## Tell me what is stuck. I will tell you what it takes.

Same consultant from the first email to the last cutover.

[Book a 20-min call](https://tenantcraft.ca/contact) [See published rates](https://tenantcraft.ca/pricing)

---

_Canonical HTML: https://tenantcraft.ca/insights/locked-out-only-microsoft-365-admin · Agent guide: https://tenantcraft.ca/llms.txt · Site map: https://tenantcraft.ca/sitemap-index.xml_