Sole Global Admin locked out - lost MFA device, SSPR phone verification returns error

You lost the usable MFA registration, revoked the remaining admin session, and SSPR cannot complete its second verification. There is no safe client-side bypass; recovery now requires an authenticated administrator or Microsoft verification. Stop repeated sign-in and reset attempts to avoid adding lockout signals. Contact Microsoft 365 business support using the organization’s registered contact details; Microsoft may verify the request through data stored in the tenant profile. If the subscription was bought through a partner, contact that partner because it owns the support route. Keep the tenant ID, custom domain, subscription or order number, billing records, and registered-contact access ready, but share them only in the support case. Ask for tenant administrator access recovery, not a public forum reset. After access is restored, create two cloud-only emergency Global Administrator accounts, register independent phishing-resistant credentials, monitor their use, and test them regularly so one lost device cannot lock the tenant again.