Forum Discussion
How to recover global admin access to tenant
I have already tried posting this to the general Microsoft Q&A forums and received no response. We are desperate to figure something out so if this is not the correct line of communication, please direct me to where I should go.
My company is in a bit of a bind right now, and I am at my wit's end after almost a week of trying to get in contact with anyone who could help.
We have multiple directories in Azure that belong to us, but they are all independent of each other. As such, some directories have multiple global admins (and thus are not an issue); others -- and quite frankly, the most important ones -- only have one global admin, and it was our DevOps person, who is no longer employed with us. We have no way of accessing his account, and thus no way of accessing a global admin account for these directories/tenants.
Access to these directories is critical to our operations. We were informed last Friday by someone from the data protection team that they could not give us access to these tenants we pay thousands of dollars a month for because:
- Our former DevOps person registered all other users as guests/external users, and DPT "can't give external users admin permissions", and
- To reset the MFA of the current global admin account, the owner of the account (who no longer works for our company) would need to contact them and verify their identity
What options do we have here? We have blobs full of user-uploaded files in these tenants. Starting over from scratch is a doomsday scenario we are trying everything we can to avoid. Surely there has to be something that can be done?
5 Replies
Use the Microsoft Entra tenant recovery and Microsoft support process with proof of domain or billing ownership, and involve another verified administrator if one exists. Do not attempt to bypass MFA or create a parallel tenant. Record the tenant ID, verified domain, last successful sign-in and the exact error so support can route an admin-recovery case safely.
Yes and seems the only way is to contact the Microsoft Support Data Protection team:
https://learn.microsoft.com/en-us/answers/questions/5923624/reset-access-to-global-admin-account
https://learn.microsoft.com/en-us/answers/questions/5782664/global-admin-access-lost
For a tenant lockout where no Global Admin can sign in, this usually has to go through Microsoft support / tenant recovery, not a normal self-service reset. I would gather proof of tenant ownership first: tenant ID, verified domain, billing/subscription details, organization proof, and the locked admin UPN. After access is restored, create at least two cloud-only emergency access accounts and monitor them, following Microsoft’s emergency access guidance.
Unfortunately, from my experience if you don't have a secondary Global admin profile you will more than likely need to take the long route. Which is to open a Microsoft support ticket which this path can take a few weeks as they need to verify you are the owner of said tenant. Hopefully this helps and you can gain access soon.
