How to replace a account administrator

A current Global Administrator must assign the replacement administrator; if no administrator account can be accessed because the former IT provider is unavailable, recover the likely administrator account or contact Microsoft Support for tenant ownership verification.

1. Look for an existing administrator account

The person who originally purchased or registered the Microsoft 365 business subscription became a Global Administrator by default. Check with the business owner, co-owner, finance staff who paid for the subscription, and anyone who received the original Microsoft 365 setup email. Search company mailboxes and records for Microsoft or onmicrosoft.com. ^1^

Ask likely account holders to sign in at the Microsoft 365 admin center:

1. Open https://admin.microsoft.com.
2. Sign in using the possible work account.
3. If Admin is available and the user can open the admin center, check Roles > Role assignments > Microsoft Entra ID > Global Administrator to identify the existing administrators.
4. If the site reports that the user lacks permission, that account is not an administrator. An ordinary licensed user cannot promote themselves. ^1^

2. If the administrator username is known but cannot sign in

Try Microsoft’s Self-Service Password Reset:

https://passwordreset.microsoftonline.com/

This works only if password recovery was configured for that administrator account and its required verification methods remain accessible. It does not give administrator rights to a normal user. If recovery is unavailable or fails, proceed to Microsoft Support. Microsoft’s tenant-lockout guidance directs customers to try self-service password reset before escalating inaccessible Global Administrator accounts. ^2^

3. If an administrator account can access the admin center

Assign the replacement account:

1. Go to Users > Active users.
2. Select the trusted user who will administer Microsoft 365.
3. Select Manage roles.
4. Select the required administrator access—use Global Administrator only if the person needs complete tenant control.
5. Select Save changes. ^3^

After verifying that the new administrator can sign in, remove the former provider’s roles or account as appropriate. Use the least-permissive role for routine work, require multifactor authentication, and retain another administrator or Privileged Authentication Administrator to reduce the risk of another lockout. ^4^

4. If no administrator can be accessed

Contact Microsoft Support and request Microsoft 365 business tenant access recovery. Explain that:

• The former IT provider created or managed the tenant and is no longer available.
• No accessible Global Administrator has been found.
• An authorized company representative needs administrative control restored.

Use Microsoft’s country or region support directory to find the appropriate contact method. ^5^

Microsoft may require evidence that the company owns or is authorized to control the tenant. Be prepared with examples such as:

• Business registration or other proof of authority.
• Proof that the company controls its email domain.
• Microsoft 365 invoices, purchase receipts, subscription details, or previous payment information.
• The affected domain and any known onmicrosoft.com tenant name or administrator username.

The exact verification documents can vary by case. Support must complete identity and ownership verification before restoring administrative control; forum moderators and ordinary users cannot bypass that process. ^6^

References

1. Overview of the Microsoft 365 admin center
2. Preventing tenant lockouts
3. Assign admin roles in the Microsoft 365 admin center
4. About administrator roles in the Microsoft 365 admin center
5. Contact Microsoft customer support
6. Microsoft 365 Login Problem - Microsoft Q&A