Sole Global Administrator locked out — no working MFA method — need account recovery

Because your only registered Authenticator device was destroyed and there is no other administrator or active session, this needs Microsoft-assisted tenant recovery, not another password reset. Knowing the password, controlling the domain, or possessing an unregistered FIDO2 key does not supply the missing registered authentication method. Contact Microsoft business support using the current official regional contact route and explain that the sole Global Administrator cannot complete MFA. Ask for the tenant access recovery process and provide the tenant and subscription identifiers privately. Keep domain ownership and billing evidence ready, but follow support’s verification instructions rather than posting financial details here. Raise the upcoming payment concern in the same case and request billing guidance; this forum cannot flag your subscription or guarantee suspension prevention. After recovery, register independent authentication methods and establish monitored emergency access administrator accounts to avoid another single-device lockout.