Locked Out of Microsoft 365 or Google Workspace by 2FA? What to Set Up Today So It Can't Stall Your Business

Why lockouts happen

In the small businesses I work with, lockouts almost always trace back to one of a few setups:

One admin account. The owner, or one long-gone office manager, is the only person who can change anything.

One sign-in method. Codes go only by text to a single phone. Lose the phone, change carriers, or switch numbers, and the second step fails.

A departed employee. The authenticator app lived on their personal phone, or the recovery email was their personal address.

Stale recovery details. The recovery phone and email on file are years out of date.

Domain access nobody remembers. Some recovery paths require you to prove you control your domain, which means signing in to your domain registrar or DNS host.

None of this is exotic. It is what happens when two-factor sign-in gets switched on in a hurry and nobody comes back to finish the setup.

The setup checklist for today

1. Give every admin at least two sign-in methods. An authenticator app on a phone plus a security key or passkey is a solid pair. Microsoft's security info pages walk users through adding an authenticator app or a security key. Google's admin best practices say security keys "help to resist phishing threats and are the most secure form of 2SV," and that "Admins should enroll more than one security key for their admin account and store it in a safe place."

2. Print or securely store recovery codes. Google lets you create backup codes "in case you lose your phone, change your phone number, or otherwise can't get codes." You get a set of 10, each works once, and generating a new set cancels the old one. Google's admin guidance is direct: "Admins should generate and print backup codes in case they're needed. Keep backup codes in a secure location." Treat them like a spare key to the building, not a sticky note on the monitor.

3. Update the recovery phone and email. Check them now, not during an emergency. Google notes on its recovery options page that "You can't add recovery info while you're locked out of your account," and that a new recovery phone number "may take up to 7 days" to take effect. It also warns against using a Google Voice number as your recovery phone, because the code could end up in the very account you can't reach.

4. Have a second admin. Google says "Your organization should have more than one super administrator account, each managed by a separate individual (avoid sharing an admin account)." Microsoft's partner guidance on preventing tenant lockouts says to "Ensure each tenant has at least two Global Admin accounts with distinct credentials and MFA methods." A business partner, a trusted manager, or your IT provider can hold the second one.

5. Create a break-glass account on Microsoft 365. Microsoft's emergency access guidance says you can "reduce the impact of accidental lack of administrative access by creating two or more emergency access accounts." These should be cloud-only accounts on the built-in Microsoft domain that ends in "onmicrosoft", with passkey (FIDO2) sign-in recommended, and Microsoft says to "Store credentials in secure, fireproof safes that are in secure, separate locations." It also says to exclude them from sign-in policies that could block them, or the account "might be unusable during the exact emergency scenarios it's designed for." For a very small business, that may feel like a lot. Even one well-documented emergency account, kept offline, is far better than none.

6. Know your support path before you need it. Write down, on paper, where help lives:

Microsoft 365: the Get support page for admins explains how to open a request from the admin center and points to a list of regional business support phone numbers.

Google Workspace: whether you bought directly from Google or through a reseller, since Google's recovery page sends reseller customers to the reseller.

Your domain registrar login. If you are not sure who controls your domain, start with our domain ownership checklist.

If you are already locked out

Microsoft 365

If anyone else in the business holds an admin role, ask them to reset your sign-in methods. In the Entra admin center, an admin can require you to register your multifactor methods again.

Try the self-service reset option on the sign-in page, if it was set up. Microsoft's partner guidance says customers "should always try recovering access through the Self Service" reset tool before contacting Microsoft.

If you were the only admin, call Microsoft business support using the regional number list. Be ready to prove you own the subscription with details like the company name, billing information, and contact info on file.

Write down the case number and the name of each person you speak with.

Google Workspace

Ask another super admin to reset your access from the Google Admin console. This is the fastest path, and it is why the second admin matters.

Otherwise, use Google's admin recovery steps. If you have a recovery phone or email, Google can send a code there.

If you don't, the recovery wizard may ask you to prove you control your domain by adding a CNAME record to your DNS settings. Google says that if the record "isn't found in 48 hours," recovery fails and you have to try again.

The wizard may offer a support-assisted recovery option. Keep the case number and any emails Google sends.

What we don't know: none of these companies promises a recovery timeline. Identity checks can take hours or days, and the result depends on what details you can prove. Plan for the slow case.

A note on QuickBooks

Intuit's help pages say multi-factor sign-in on unrecognized devices can't be turned off, and they recommend adding extra verification methods: a current email and phone, a passkey, and an authenticator app, all under Sign in and security. If you lose access to both your phone and email, Intuit's account recovery page describes a form where you upload a photo ID, processed during Pacific business hours on weekdays. Make sure at least two people with the right roles can get into your books.

Keep it current

Put a recurring reminder on the calendar every quarter: confirm each admin can still sign in, check that the recovery details are current, and confirm the codes are where you think they are. Do the same any time someone leaves. If you are tightening security more broadly, our email phishing checklist and hacked website checklist cover the next layers.

How Local Business Search can help

Local Business Search offers small-business IT support. We will audit your Microsoft 365, Google Workspace, and QuickBooks admin and recovery setup, add a second admin and backup sign-in methods, and document your support path so a lost phone stays a minor hassle. Done-for-you how-to videos for these setups are coming soon.