Locked out of the Microsoft 365 admin centre? How to get back in
Email works, Teams works, and nobody has signed in to admin.microsoft.com in years. Then a staff member leaves, a licence needs adding or a password needs resetting, and it turns out the only admin login belongs to someone who has gone, or to the IT company you stopped using. Here is how a business works out what it has and gets its own admin access back.
Last updated
The short answer
First find out whether anyone still has an admin role: another admin can reset a locked admin's password in Users, Active users. If the admin just forgot the password, the Forgot password link on the sign-in page works for admins too, as long as two recovery methods are on the account. If an old IT provider holds the only login, ask them in writing to add a Global Administrator in the business's name, then remove their partner roles. If nobody can sign in at all, contact Microsoft support. WaTo Consulting works through these routes with Adelaide businesses and leaves the admin accounts in the owner's hands.
What the admin account and the onmicrosoft.com address are
Every Microsoft 365 subscription sits in a tenant, and every tenant gets a built-in address ending in .onmicrosoft.com when it is first set up, such as yourbusiness.onmicrosoft.com. Microsoft keeps it behind the scenes and it cannot be renamed or removed. The person who signs up becomes the Global Administrator by default, the role that controls users, billing, security and domains. In many small businesses that person was a web designer, a former staff member or a previous IT provider, and nobody else was ever given the role.
What to check first
Which tenant is ours?
Your SharePoint web address is based on your onmicrosoft.com name. If a staff member opens SharePoint or OneDrive in a browser, the start of the address (yourbusiness.sharepoint.com) tells you the tenant name.
Does anyone else have admin?
Ask long-serving staff to try admin.microsoft.com. Anyone who gets in can check Roles, Role assignments to see who holds Global Administrator.
Who bills you?
If the invoices come from an IT company rather than Microsoft, a partner bought the licences. Microsoft sends support for partner-bought subscriptions back to that partner.
Whose phone is on the account?
Password resets and Microsoft's phone checks use the contact details saved on the admin account. If those belong to the old provider, plan for that before you call anyone.
Who this is for
- A business whose Microsoft 365 was set up by someone who has since left or closed down.
- An owner changing IT providers who has just found the only admin login is not theirs.
- An owner who is the only Global Administrator and has lost the phone or password that goes with it.
How to get admin access back
- Reset the password yourself. At the Microsoft sign-in page, enter the admin address and choose Forgot password. Admin accounts can reset their own password by default, but Microsoft asks for two checks, such as an email address, an authenticator app or a phone number. If those still belong to the business, this takes minutes.
- Ask another admin. If anyone else holds an admin role that can reset passwords, they can go to Users, Active users, select the locked admin and choose Reset password.
- Go through the old provider. If the provider set it up, send a written request for a new Global Administrator account in the business's name. Once you are in, go to Settings, Partner relationships, select their company and choose Remove roles. That removes their admin roles but not the reseller relationship, which you end with them directly.
- Contact Microsoft support. If nobody can sign in, call Microsoft using its global phone numbers list. Microsoft verifies callers, and may send a code to the email or phone registered on your admin profile, so have your business details, invoices and domain registrar login ready.
- Lock it down afterwards. Give the role to two people the business trusts, put the owner's own phone on their admin account, turn on multi-factor authentication and remove any admin accounts nobody can explain.
How WaTo can help
- We work out which tenant you have, who holds the admin roles and who bills you before anyone contacts the old provider.
- We handle the provider conversation and the partner role removal as part of changing IT provider.
- Afterwards the admin accounts sit in the business's name, set up the way Microsoft recommends, and we look after them under Microsoft 365 management. If we need our own access, we ask for it the way our add an admin guide shows.
Microsoft 365 admin access questions
Our old IT company has the only Office 365 admin login. What can we do?
Ask them in writing to create a Global Administrator account in the business's name. Once you are in, remove their roles under Settings, Partner relationships, and check Roles for any admin accounts they still hold. If they bought your licences, Microsoft will point support questions back to them until that changes, so it pays to keep the request polite and on record.
What is admin.onmicrosoft.com and how do I find ours?
It is the built-in tenant address Microsoft gives every subscription, such as admin@yourbusiness.onmicrosoft.com. Admin accounts are often created on it. To find yours, open SharePoint or OneDrive in a browser: the first part of the web address before .sharepoint.com matches your onmicrosoft.com name.
I forgot my 365 admin password. Can I reset it myself?
Usually yes. Choose Forgot password at sign-in. In a business tenant with its own domain, admin accounts need two recovery methods, such as an authenticator app and a phone number, and security questions are not accepted. If only one method was ever set up, another admin or Microsoft support will need to help.
What if nobody in the business can sign in as an admin?
Contact Microsoft support using the global phone numbers list on Microsoft's site. Expect to prove who you are and that the business owns the subscription. If you bought everything through a partner, Microsoft will refer you to that partner.
Can we take over the tenant by proving we own the domain?
Only in one case. Microsoft's admin takeover is for unmanaged tenants, the kind created when staff sign up for a free Microsoft service with their work email. You prove ownership by adding a record at your domain registrar. A paid Microsoft 365 tenant that already has an admin needs one of the other routes.
How many Global Administrators should we have?
At least two, and fewer than five. Microsoft also recommends two emergency access (break glass) accounts on the .onmicrosoft.com address, not tied to one person, protected by a passkey and tested at least every 90 days.
How WaTo can help with this
- Changing IT provider
- IT takeover and documentation
- Microsoft 365 management
- Microsoft 365 health check
Guides on this topic
- How to add an admin to your Microsoft 365 tenant
- What to do in Microsoft 365 when someone leaves
- Locked out of Google Workspace admin? How to get control back
- Changing IT providers: a practical onboarding checklist
Sources & references
- Microsoft Learn: Microsoft 365 admin center overview (who is an admin)
- Microsoft Learn: Domains frequently asked questions (the onmicrosoft.com domain)
- Microsoft Learn: Reset passwords in Microsoft 365
- Microsoft Learn: Self-service password reset policies (administrator reset policy)
- Microsoft Learn: Assign admin roles in the Microsoft 365 admin center
- Microsoft Learn: Get support for Microsoft 365 for business
- Microsoft Learn: Manage Microsoft-certified solution provider partner relationships
- Microsoft Learn: Admin takeover of an unmanaged directory
- Microsoft Learn: Best practices for Microsoft Entra roles
- Microsoft Learn: Manage emergency access admin accounts
WaTo Consulting. Last reviewed 2026-11-13. Review every six months, or when Microsoft changes admin password reset, support or partner relationship steps.
Locked out of Microsoft 365 right now?
Call us or book a time. We will work out the quickest route back in, then make sure the admin accounts end up in your name.
Mon to Fri, 8:30am to 5pm
