Sole Global Administrator locked out – MFA Error 399287 – phone support unreachable

Hi Petra,

Based on the information provided, error code 399287 is related to the SMS verification method used for multi-factor authentication (MFA). It generally means that Microsoft’s security system has temporarily blocked or restricted SMS verification for the registered phone number due to phone-reputation or risk signals. Therefore, disabling the option that blocks messages from unknown senders on your phone may not resolve the issue, as the restriction may be occurring on the Microsoft authentication service rather than on your device.  

Please avoid requesting the SMS code repeatedly for now, as repeated attempts may not remove the restriction. 

To regain access, please follow the option that applies to your organization: 

If you are the only administrator and no longer have access to any registered verification method. In this situation, you need to contact the Microsoft Data Protection Team. They are the appropriate team to verify tenant ownership and assist with recovering access to the Global Administrator account. 

• Please try locating the appropriate hotline for your region here: Customer service phone numbers - Microsoft Support  

Due to the sensitive nature of Global Administrator privileges, Microsoft must complete the required ownership verification before any MFA reset or tenant recovery action can be performed. 

Here are some tips and an example of a prompt to help you navigate the IVR more effectively:  

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)    

In some regions, the initial interaction may be automated, so here’s a general idea of how the conversation might go to help you prepare:      

• What kind of problem are you experiencing?         
• Answer: Authenticator   
• What products do you use?         
• Answer: Office 365 for business         
• Is this for an education or company account?         
• Answer: For companies         
• Are you an administrator?         
• Answer: Yes         
• Are there any other administrators in your organization?         
• Answer: No. I am the only admin in my tenant          
• Do you need a... Service request?          
• Answer: Yes. I need to create a ticket. Please send me direct to the Data Protection Teams.      

When reaching out to the Data Protection team, please be prepared to provide any requested information, such as: 

• Tenant name/domain 
• Affected administrator account 
• Microsoft 365 subscription details 
• Proof of tenant/domain ownership, if required 
• Billing or subscription-related verification information 
• Any organizational documents requested by the recovery team 

If you have not yet spoken with the Microsoft Data Protection Team by phone but have already created a support ticket for your new tenant, please wait for the Data Protection Team to contact you. They may currently be handling a high volume of cases, which could be causing a delay. In the meantime, you can provide the following information via email to the agent who is handling your case and ask them to assist you further:

• Tenant ID:
• Email address:
• Screenshot or copy of the most recent invoice:
• Phone number: Available time for contact:
• TXT record:

Please send these details to the agent and request their assistance in expediting the review of your case.

I would like to clarify that I am only a regular user on this forum and do not have the ability to create support tickets, contact Microsoft on your behalf, or escalate cases directly to the Data Protection or Tenant Recovery Team. The suggestions I shared were based on methods that have helped other users reach support successfully.

I hope this helps, and I wish you the best in getting connected with the appropriate support team.

Kind regards,