Home › Guides

What to do when you’re the only Microsoft 365 admin (and how not to get locked out)

By Greg Mitchell · Squared Away Tech · October 21, 2026

“I’m the only admin and I’m locked out.” That sentence, or something close to it, shows up again and again on Microsoft’s own help forums. In one recent week, close to half of the new small-business questions in Microsoft’s subscription and billing forum were about lost admin access, broken Authenticator apps, or MFA lockouts. Owners describe being “unable to run my business” with “no one to call,” and some say it took more than a week to get back in.

The story is almost always the same. One person set up Microsoft 365 years ago. That person is the only Global Administrator. Then they get a new phone, lose the Authenticator app, have their text-message codes blocked, or simply leave the company. Now nobody can reset passwords, add licenses, or fix email, and Microsoft support has to verify who you are before it will help.

The good news: this is one of the cheapest problems in IT to prevent. It takes about an hour, and you don’t need to buy anything. This guide walks through it for small offices around Bradenton, Sarasota, and Lakewood Ranch, and it covers what to do if you’re already locked out.

Why one admin is one lost phone away from a shutdown

The Global Administrator is the master key to your Microsoft 365 tenant (your company’s whole Microsoft 365 setup). It is the account that can reset other people’s passwords, change MFA, pay the bill, and manage your domain. If that account is the only one, every one of these everyday events can lock the whole office out:

• A phone upgrade. The owner trades in the old phone before moving Microsoft Authenticator, and the new phone can’t approve sign-ins.
• Text codes stop arriving. Microsoft sometimes blocks SMS codes to a number it flags (owners report error 399287), and if text messages are the only sign-in method, there is no way in.
• The person who set it up leaves. We hear versions of “my former office manager set everything up, and I no longer know who has admin access.” Sometimes the admin account is tied to that person’s personal cell phone.
• A missed payment. A declined card can suspend a subscription, and if the only admin can’t sign in to fix billing, email goes dark.

When this happens, recovery runs through Microsoft support. They have to confirm you own the business and the domain, and owners describe repeated calls, automated phone systems, and days of waiting. For a dental office, law firm, or real estate team, that is days without email, calendars, or client files.

Step 1: Find out who your admins are today

Before you change anything, find out where you stand. This takes five minutes.

1. Sign in at admin.microsoft.com with the account you believe is the admin.
2. Go to Roles, then Role assignments.
3. Click Global Administrator and open the list of assigned users.
4. Write down every name. Note anyone who no longer works for you, and anyone whose account you don’t recognize.

If you see only one name, you have found the problem this guide fixes. If you see a former employee or an old IT vendor, that is a security issue too: they still hold the master key. (For other gaps like this, see signs your Microsoft 365 tenant isn’t locked down.)

Step 2: Add a second named admin

Pick one other trusted person, such as a partner, practice manager, or your outside IT provider, and give them admin rights on their own account. Never share one login between two people.

1. In the admin center, go to Users, then Active users, and select the person.
2. Choose Manage roles, select Admin center access, and check Global Administrator. Save.
3. Make sure that person sets up MFA on their own phone, not yours.

Two people with Global Administrator is a good number for a small office. More than four is usually too many, because every admin is a target for phishing.

Step 3: Create an emergency “break-glass” account

Microsoft itself recommends that every organization keep an emergency access account, often called a break-glass account. It is a spare admin account nobody uses day to day. It exists only for the day the normal admins can’t get in.

1. Create a new user with a plain name like emergency-admin, using your built-in yourcompany.onmicrosoft.com address rather than your custom domain, so it still works even if something goes wrong with your domain.
2. Give it the Global Administrator role. It doesn’t need a paid license.
3. Give it a very long password (20+ characters) that nobody uses anywhere else.
4. Give it its own sign-in method that doesn’t depend on anyone’s personal phone. A hardware security key (a small USB key, about $25 to $50) kept in the office safe is a good choice. Microsoft now requires MFA for admin portals, so the account needs a method of its own.
5. If your office uses Conditional Access rules (sign-in policies that block certain locations or devices), follow Microsoft’s guidance and exclude this account from them, so a bad rule can’t lock it out too.
6. Store the password and the key separately: for example, the password sealed in an envelope in a safe deposit box or a business password manager, and the key in the office safe.

Step 4: Give every admin at least two ways to sign in

Most lockouts happen because the admin has exactly one sign-in method. Fix that for every admin account.

1. Each admin goes to mysignins.microsoft.com, then Security info.
2. Confirm Microsoft Authenticator is set up on their current phone.
3. Add at least one more method: a security key, a second phone, or an office phone number. Don’t rely on text-message codes alone.
4. Before you trade in or wipe a phone, set up Authenticator on the new phone first, approve a test sign-in, and only then wipe the old one.

Step 5: Write down where the keys live

Put one page in a safe place, on paper or in your business password manager, that answers these questions: who the admins are, where the emergency account details are stored, which email gets Microsoft billing notices, what card pays the bill, and who registered your domain (and where that login lives). When someone is locked out at 8 AM on a Monday, this page saves hours.

Step 6: When someone leaves, move the keys the same day

If an office manager or admin leaves, don’t just block their mailbox. On their last day, confirm another admin can sign in, remove their admin role, remove their personal cell phone from any account’s sign-in methods, and change the billing contact if it was theirs. Owners on Microsoft’s forums describe accounts locked for days because a former employee’s personal number was still the only way in.

If you’re already locked out

• Check for another admin first. If anyone else has admin rights, they can reset your MFA from the admin center in minutes.
• Try every sign-in method you ever set up, including an old phone, a backup number, or an office line.
• Contact Microsoft support from a different account or the public sign-in page and be ready to prove ownership: your domain, billing details, and business documents. Expect it to take time, and keep notes of every case number.
• Don’t pay anyone who promises a back door. Scammers target owners in exactly this spot. If someone calls you claiming to be Microsoft, hang up and call back through official channels.

Once you’re back in, do Steps 1 through 6 the same week. If the lockout followed a suspicious sign-in, also read what to do if a Microsoft 365 account is hacked and unexpected MFA prompt? Check your inbox forwarding rules too.

If the admin account belongs to an old IT company or someone who has left, see who really owns your Microsoft 365, and how to take it back.

Why this matters for local offices

Most small offices from Ellenton and Palmetto down to Venice don’t have an IT department. Microsoft 365 was set up once, often by an office manager, a family member, or a vendor who has since moved on. Hurricane season adds another twist: if the one admin is evacuated, without power, or out of cell coverage, nobody else can reset a password or recover a mailbox. A second admin and a tested emergency account are what keep the office running when one person can’t be reached. Many cyber insurance applications also ask about admin accounts and MFA; see does your cyber insurance require MFA.

FAQ

How many Global Administrators should a small office have?

Two named admins plus one emergency break-glass account is a good setup for most offices of 5 to 50 people. One is too few, and more than four makes the master key a bigger phishing target.

What is a break-glass account in Microsoft 365?

It is a spare Global Administrator account that nobody uses day to day. It has a very long password, its own sign-in method that doesn’t depend on a personal phone, and it is stored safely so you can get back in if your normal admins are locked out.

I’m getting a new phone. How do I avoid getting locked out?

Before you trade in or wipe the old phone, install Microsoft Authenticator on the new one, add it under Security info at mysignins.microsoft.com, and approve a test sign-in. Keep a second method, such as a security key or another phone number, on file.

The person who set up our Microsoft 365 left. What should we do?

Check Roles in the Microsoft 365 admin center to see who holds Global Administrator. If you can still sign in as an admin, add a new admin, remove the former employee’s role and personal phone number, and update the billing contact. If nobody can sign in, you will need to work with Microsoft support to prove ownership.

Are text-message codes good enough for admin accounts?

Not on their own. Text codes can be delayed or blocked, and phone numbers can be stolen. Use Microsoft Authenticator or a security key as the main method and keep a text or call option only as a backup.

Does setting up a second admin cost extra?

No. Admin roles are free to assign to existing users, and an emergency access account does not need a paid license. The only optional cost is a hardware security key.

Squared Away Tech serves offices of 5 to 100 people in the Tampa Bay and Sarasota area (Bradenton, Sarasota, Tampa, Ellenton, Lakewood Ranch, St. Petersburg, Palmetto, Venice and Parrish), serving small offices across Florida, and remotely anywhere in the U.S. Mon–Fri 5–9 PM and Sat 9 AM–5 PM (Eastern Time). Daytime and Sunday appointments available on request; daytime calls get a same-evening callback. Back to the home page · More guides

This guide is general information, not legal or insurance advice. Every office’s setup is different.