MCT Azure Portal Lockout - MFA Code Mismatch & No Push Notification?

Updating this thread as I am still unable to access my MCT benefit tenant. As the sole Global Admin, I am completely blocked from managing my resources. Is there a way to escalate this to the Data Protection Team for a manual MFA reset?

The symptoms indicate an MFA problem where the only registered method (Microsoft Authenticator) is not working and there is no alternative verification method or additional admin to reset it. In this situation, self-service recovery is not possible and the tenant must be recovered by Microsoft support.

Based on similar cases:

1. When another global admin exists, that admin can fix this by:
   • Signing in to the Azure portal → Microsoft Entra ID → Users → select the affected user → Authentication methods → Require re-register multifactor authentication.
   • After this, the next sign-in prompts a fresh MFA registration.
2. When there is no other global admin (your case):
   • This is treated as a tenant lockout / Data Protection scenario.
   • Microsoft support (Data Protection / Tenant Recovery team) must verify tenant ownership and then reset MFA or restore access.
3. For similar lockout situations (lost phone, bad phone reputation, only one global admin), resolution was achieved only after:
   • Opening a support ticket and having the Data Protection team reset MFA or restore access to the tenant.

Action path for this scenario:

1. From any Microsoft 365/Azure-related support entry point where sign-in is still possible (for example, using the same account in Outlook or other services), initiate a support request describing:
   • Global admin locked out of Azure portal.
   • Only admin on the tenant.
   • Microsoft Authenticator push not arriving and code mismatch.
   • No alternative MFA methods configured.
2. In the support request, explicitly ask for escalation to Data Protection / Tenant Recovery to:
   • Verify ownership of the tenant.
   • Reset MFA registration for the global admin account.
3. After Data Protection resets MFA:
   • Sign in again; the account will be prompted to re-register MFA.
   • Configure multiple methods (e.g., Microsoft Authenticator plus phone/SMS) and, if possible, add a second global admin to avoid future lockouts.

There is no supported way to bypass or reset MFA from the portal when the only global admin is locked out and no alternative methods exist; Microsoft support must intervene.

References:

• Troubleshoot Azure Multi-Factor Authentication issues
• "We did not receive the expected response" error message when you try to sign in by using Azure Multi-Factor Authentication
• Common problems with two-step verification for a work or school account
• I need to reset my mfa methods - Microsoft Q&A
• Global Admin Locked out - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• Azure has blocked myphone number for SMS verification due to a “bad reputation” flag - Microsoft Q&A