Locked Out of Her Own Microsoft 365 Tenant: A Same-Day Recovery Case Study

A client called us in a panic: she couldn't get into her own Microsoft 365 account. She was the sole admin on her tenant -- no second admin, no break-glass account, nothing to fall back on -- and the device tied to her multi-factor authentication had stopped working. No working MFA and no other admin meant there was no self-service way back in. She was locked out of her own business.

Why This Wasn't a Simple Password Reset

A normal "forgot my password" flow assumes you can still complete MFA, or that someone else with admin rights can vouch for you and reset it on your behalf. Neither was true here. This is exactly the scenario a break-glass account -- a secondary, tightly controlled admin account kept in reserve for emergencies -- exists to prevent. She didn't have one, which meant getting back in required going around the normal recovery path entirely.

What Was Actually at Stake

This wasn't just an inconvenience. She was locked out for nearly 24 hours, during which she had no access to email or payroll, and needed to respond to clients about a large, time-sensitive order. Every hour the lockout continued was an hour of real business risk, not just a technical annoyance.

The Recovery: Microsoft 365 Admin Recovery and Support Escalation

With no break-glass account and no working MFA, the fix ran through Microsoft's own admin recovery process -- a support escalation that required proving domain and business ownership directly to Microsoft, rather than through the tenant's own (inaccessible) admin tools. We got her back into her account, and full access to email and payroll, within the same day.

Why We Didn't Just Set Up a Break-Glass Account

The standard fix after an incident like this is a break-glass account -- a secondary admin credential, stored securely, used only in an emergency. We considered it here too. But she's an elderly business owner who was never going to be the one managing a separate emergency credential, remembering where it's stored, or keeping it current. A safeguard she couldn't realistically maintain herself isn't really a safeguard.

Instead, I became her tenant admin directly, so there's always someone available to help if this happens again -- a fix built around how she actually works, not a generic best-practice checklist applied without asking whether she could keep it up herself.

If you're the only admin on your Microsoft 365 tenant and don't have a real recovery plan in place, you're one dead device or forgotten password away from being locked out of your own business, the same way she was. That's worth fixing before it becomes an emergency -- schedule a free consultation and we'll assess what a real safety net looks like for how your business actually operates.