Sole Global Admin locked out – MFA error 399287 – Microsoft 365 Business

Kjetil Korstvedt 0 Reputation points
2026-11-03T13:35:44.59+00:00

Hello Microsoft Support Team,

I am requesting assistance with recovering administrator access to our company's Microsoft 365 Business Standard tenant.

The problem

I am unable to sign in to our original Microsoft 365 tenant because SMS-based identity verification consistently fails with error code 399287.

The registered mobile phone number is correct, active, and belongs to me. However, Microsoft fails to complete the verification process.

What I have already tried:

  • Successfully resetting the account password using the registered recovery email address.

Signing in again with the new password.

Testing different browsers, including private browsing sessions.

Repeating the login process on different occasions.

Checking whether Microsoft Authenticator is available. It is not configured for this account.

The password reset succeeds, but I am immediately redirected to the same failed SMS verification process.

Business impact

Our company has a paid Microsoft 365 Business Standard subscription, but I cannot access the Microsoft 365 admin center to manage our users, licenses, subscriptions, or security settings.

I am the administrator attempting to recover access and currently have no working administrative sign-in.

Assistance requested

Could a Microsoft moderator please help me reach the appropriate Microsoft 365 Data Protection or Entra ID support team?

I specifically request:

Investigation of error 399287 and any possible PhoneReputation/BadReputation restriction.

Assistance restoring administrator access through an official identity-verification procedure.

An alternative verification method or an authorized MFA reset if necessary.

I can provide company registration documents, subscription invoices, proof of payment, tenant ID, affected account details, and diagnostic identifiers privately through an official Microsoft support channel.

Please advise how I can open a support case when the administrator account itself is locked out.

Thank you for your assistance.

Microsoft 365 and Office | Subscription, account, billing | For business | Other
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Julie Huynh 4,105 Reputation points Independent Advisor
    2026-11-03T14:15:20.01+00:00

    Dear @Kjetil Korstvedt ,

    Good day! Welcome to Microsoft Q&A forum!

    First of all, I would like to clarify that this is a community forum where users help one another. No one here, including myself, has access to your Microsoft 365 tenant, account details, billing information, or authentication settings.

    You could refer to this question answered by a moderator here: Sole Global Administrator locked out. Microsoft Authenticator is the only registered MFA method

    {8E1043D9-A9B4-44C7-BF3E-68690A016A90}

    Regarding your situation, error code 399287 generally indicates that Microsoft is unable to complete the SMS-based MFA verification process for the registered phone number, which can occur due to service-side validation, phone reputation, or backend authentication issues even when the password and phone number are correct.

    If you're the only admin, in this situation, the Microsoft Data Protection Team has tools and processes in place to verify identity and regain access to administrator accounts.

    Please try to find the related hotline number to call the frontline let them raise a ticket for you: Technical or Sales support phone numbers (for Work account, scroll down to find your region's number) 

    In some countries, this is an automated conversation: First, when you call the hotline, they will ask you what kind of problem you are struggling with. 

    Answer: Authenticator. 

    A: What products do you use? 

    B: Office 365 for business. 

    Verification: Education or company account? 

    B: For companies 

    A: Are you an administrator? 

    B: Yes. 

    A: Are there any other administrators in your organization? 

    B: No. 

    A: I need one.... Service request? 

    B: Yes 

    (Important Note to reach a live support agent: Sometimes, you would hear the computer-generated voice at first, please kindly wait for it to end, and if an agent is available, you would be directed to them and get your support. Depending on your country or region, when you call the support number, you may hear an introduction of about 30 seconds such as "You can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.) 

    Also, could you kindly check if you know someone with Admin rights to a Microsoft 365 Business tenant that could help raise a support ticket on your behalf (with your contact information in the ticket's description so that the Data Protection Team could reach out to you)?

    As an alternative, you can create a new tenant account and submit your request from there.    

    To set up a new tenant, please follow these steps: 

    Once your tenant is created, you should be able to access the support portal and submit your ticket referencing your locked account without further issues.

    In the ticket's description, you could refer to this message "Hello,

    I am currently locked out of my Microsoft 365 tenant because multi-factor authentication is enforced, and I am unable to complete the verification process because of the error 399287. I am the only global administrator for this tenant, which means I cannot access my account or the Microsoft 365 Admin Center.

    To resolve this, I have created a new tenant and would like to be connected with the Data Protection Team to verify my identity and assist with regaining access. I am available to provide any required documentation or verification to support the recovery process."

    Ticket Support: Log in the Microsoft 365 Admin Center using the newly created trial admin account (not the currently locked one) > Support > Help & Support. You can raise support ticket at: https://admin.microsoft.com/#/support/requests   

    When you open a support ticket, please make sure to turn off the Support Assistant (AI) in the help panel.  

    Several customers have reported issues when the Support Assistant is turned on  the system sometimes fails to display the “Contact Support” option.  

    As shown in the screenshot, simply switch Support Assistant > Off, then type your issue description.  Once the AI is off, the “Contact Support” button will appear normally, allowing you to submit a ticket directly.  

    User's image

    • After clicking on "Help & Support" button, you can type "I need agent support via phone or email". After that, you can click on "Contact support" 
    • Choose contact method: "Phone" 
    • Fill all the information in this contact support details, please describe your situation carefully so they will have enough information to help you. 
    • Finally, click on "Contact me"
    • After completing them, you will receive an email appointment for a meeting to review this issue professionally together. 
    • For more details, you could refer to this article: Get support for Microsoft 365 for business 
    • This new trial tenant will not give you access to any of the data or settings in your original locked tenant. It is solely a temporary means to contact Microsoft support.   
    • Be prepared for Microsoft support to ask for verification of your identity and administrative rights for the locked tenant.   
    • The resolution time might be longer as you are contacting support from a different tenant.   
    • Remember to cancel the trial subscription for the new tenant once your issue with the original account is resolved to avoid any unintended charges. You can typically do this within the Microsoft 365 Admin Center under "Billing" > "Your products."

    Once access has been restored, I would recommend registering multiple authentication methods and maintaining at least one additional emergency administrator account to help prevent a similar lockout situation in the future.

    Kindly let me know when there are updates or if you need further assistance. Any updates you’re able to share would be really helpful.

    I'm here and happy to help! Thank you for your kindness and patience! 

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-11-03T13:36:46.39+00:00

    Contact Microsoft business support from outside the locked tenant and request a “sole Global Administrator tenant-lockout case” escalated to the Microsoft 365 Data Protection/Tenant Recovery team; a forum moderator cannot reset MFA or remove an SMS block.

    Open the recovery case

    1. Open Microsoft’s regional support directory and select the business/technical-support number for your country or region: ^1^
    2. Tell the automated system or agent:
      • Product: Office 365/Microsoft 365 for business
      • Account type: Business/work account
      • Role: Administrator
      • Other administrators available: No
      • Request: Create a service request for a tenant lockout and route it to the Data Protection/Tenant Recovery team
    3. Use this case description:

    The sole Global Administrator of our Microsoft 365 Business Standard tenant is locked out. The password is accepted, but the only registered MFA method—SMS—fails with error 399287. No alternate authentication method or other Global Administrator is available. Please open a tenant-lockout recovery case and escalate it to the Microsoft 365 Data Protection/Tenant Recovery team for identity verification and an authorized MFA reset or restoration of administrative access.

    This escalation is the resolution used in matching cases involving error 399287, SMS MFA failure, and no second administrator. The Data Protection team performs the required identity verification and account-recovery process.^2^ Microsoft Q&A moderators and community members cannot access the tenant, reset MFA, or remove the SMS restriction.^3^

    Information to prepare privately

    Have the following available for the assigned support agent:

    • Tenant’s initial *.onmicrosoft.com domain and custom domain
    • Locked administrator username
    • Microsoft 365 subscription and billing information
    • Company legal name and registration documents
    • Invoices or proof of payment
    • Alternate email address and telephone number
    • Affected MFA telephone number
    • Error 399287
    • Request ID, correlation ID, and timestamp from the failed sign-in page
    • Access to the organization’s public DNS, if ownership verification is requested

    Provide this information only through the official support case—not in this public forum. Matching recovery cases indicate that company, billing, phone, and alternate-contact information may be used during verification.^4^

    Do not state that PhoneReputation or BadReputation is the confirmed cause. Ask support to investigate whether the SMS method is subject to such a restriction. Error 399287 and the failed operation alone do not establish the backend cause.

    If telephone routing does not produce a case

    • Use Microsoft’s public support contact page, enter “Sole Global Administrator locked out of Microsoft 365; SMS MFA error 399287”, select Get Help, and then Contact Support when offered.^5^
    • If the subscription was purchased through a Microsoft partner or reseller, ask that provider to open the Microsoft service request on the tenant’s behalf.
    • As a last fallback, a matching Q&A resolution recommends creating a separate trial tenant, signing into its admin center, and submitting a support request that clearly identifies the inaccessible original tenant and requests Data Protection escalation.^2^

    Since password reset, browser changes, private sessions, and Authenticator have already been exhausted or are unavailable, repeating them will not resolve this MFA dead end. Also avoid repeatedly requesting SMS codes: Microsoft documents that repeated attempts can trigger or extend temporary verification restrictions.^6^

    After access is restored

    Create at least two cloud-only emergency-access accounts with distinct, phishing-resistant authentication methods, securely store their credentials, exclude them from policies that could block emergency sign-in, monitor their use, and test them regularly. Microsoft recommends two or more emergency-access accounts specifically to prevent administrative lockout.^7^

    References

    1. Contact Microsoft customer support
    2. Sole Global Administrator locked out - MFA SMS blocked with error 399287 - Microsoft Q&A
    3. Sole global administrator locked out – SMS MFA blocked (error 399287) - Microsoft Q&A
    4. Global Admin locked out – SMS MFA error 399287 (phone number blocked) - Microsoft Q&A
    5. Contact Microsoft customer support | Microsoft Support
    6. Common problems with two-step verification for a work or school account
    7. Manage emergency access accounts in Microsoft Entra ID
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.