Wɔatoto mu wɔ Google Adwumayɛbea anaa Microsoft 365 Admin Console: DNS TXT a Wɔfa ne Nea Wɔsan Yɛ¶

Sɛ wuhu sɛ w’adwumakuw, mmara adwumayɛbea, aduruyɛ adwumayɛbea, anaa adwumakuw a wɔnyɛ adwuma a mfaso wɔ so no atoto mu koraa wɔ ne Google Workspace (admin.google.com) anaa Microsoft 365 / Entra ID (admin.microsoft.com) cloud tenant ɛfiri sɛ Super Administrator anaa Global Administrator nko ara hweree wɔn smartphone a wɔn Microsoft/Google Authenticator MFA aba ka ho, gyaw adwumakuo no wɔ ɔtan nsɛm mu na ɔsesaa password no, anaasɛ ɔwuiɛ mpofirim no yɛ existential business continuity crisis. Sɛ wunni adwumayɛfo kwan a, wuntumi mfa adwumayɛfo nka ho anaasɛ wonyi mfi hɔ, nsan nsiesie user passwords a wɔatoto mu, update billing cards a ne bere atwam ansa na wo company no email nyinaa aba (MX) and SharePoint/Google Drive infrastructure is suspended, or revoke a rogue ex-admin's session tokens. Fortunately, both Google and Microsoft engineer their enterprise identity platforms around a foundational cryptographic truth: ultimate legal ownership of a custom-domain cloud tenant belongs to the entity that controls the domain name's authoritative Public DNS zone at the Domain Registrar (such as Cloudflare, AWS Route 53, GoDaddy, or Namecheap). Even if zero admins can log in and every hardware YubiKey or Authenticator app is gone, you can execute an emergency DNS TXT anaasɛ CNAME Domain Ownership Takeover Challenge (ɛnam Google automated so toolbox.googleapps.com/apps/recovery/form pipeline, Microsoft's Internal Admin Takeover (Unmanaged Tenant) flow, or a Microsoft Data Protection Team (DPT) DNS Verification Ticket) de yi MFA fi admin akontaabu a wɔatoto mu no mu anaasɛ wɔbɛhyɛ adwumayɛfo akontaabu a ɛwɔ hɔ dedaw a ɛyɛ gyinapɛn ho nkuran akɔ Super/Global Administrator a edi mũ. Sɛ kan odwumayɛni anaa ransomware ntuafo bi a ɔyɛ ɔtamfo de nsi retutu adwumakuw sikakorabea sika anaa ayarefo ho nsɛm bere a ɔreto wo mu a, frɛ wo mpɔtam hɔ nɔma ahorow a egye ntɛmpɛ (911 wɔ United States ne Canada, 999 wɔ United Kingdom, 112 wɔ Europa Aman Nkabom no nyinaa mu) anaasɛ wɔbɔ FBI IC3 / CISA a wɔde wɔn ho hyɛɛ mu no ho amanneɛ ntɛm ara. Sɛ wopɛ domain, akontaabu, ne nneɛma abien a egye ntɛmpɛ a ɛfa ho a, hwɛ yɛn akwankyerɛ ahorow a ɛfa ho domain din a wɔkyere, DNS a ne bere atwam, ne wɛbsaet a wɔfa, . cloud account bara a wɔbara ne data takeout adesrɛ, na nneɛma abien a ɛma wogye di telefon nɔma a wɔsan de di dwuma ne SMS a wɔde to mu.

Yɛ eyi mprempren¶

1. Hwɛ kwan a wobɛfa so akɔ wo Public Domain Registrar ne Authoritative DNS Host no so ntɛm ara. Ansa na wobɛka Google anaa Microsoft recovery forms no, hwɛ sɛ wubetumi akɔ Authoritative DNS zone no mu ama wo company no domain titiriw (yourcompany.com). Hwehwɛ wo Nameservers a ɛyɛ adwuma (NS kyerɛwtohɔ ahorow) a wɔde di dwuma dig NS yourcompany.com +short anaasɛ whois yourcompany.com. Sɛ́ ebia wo DNS no wɔ Cloudflare, AWS Route 53, GoDaddy, Namecheap, anaa Network Solutions, obiara a obetumi atintim foforo TXT anaasɛ CNAME kyerɛwtohɔ wɔ ntini no so (@) a ɛwɔ wo domain zone no mu no kura safoa titiriw a ɛbɛma woahu sɛ wowɔ mmara kwan so wuranom ama Google ne Microsoft.
2. Audit sɛ ebia BIARA a ɛto so abien admin anaasɛ Cloud Solution Provider (CSP / Reseller) da so ara wɔ partial access. Ahyehyɛde pii gye di sɛ wɔwɔ admin "baako" pɛ, na wɔn werɛ fi sɛ:
3. Abɔnten so Ɔsom a Wɔhwɛ So (MSP) anaa Mununkum Ano aduru Ma (CSP) ɔdetɔnfo (te sɛ Pax8, Ingram Micro, CDW, Sherweb, anaa GoDaddy) kura Granular Delegated Admin Privileges (GDAP / . DAP) kɔ wo Microsoft 365 anaa Google Workspace tenant mu na wobɛtumi asan asiesie wo Global Admin MFA wɔ sikani 60 mu; ANAASƐ
4. Ɔhwɛfoɔ a ɔtɔ so mmienu kura Privileged Authentication Administrator dwumadie wɔ Microsoft Entra ID (a ɛwɔ tumi a ɛwie pɛyɛ sɛ ɛbɛsan asiesie MFA ne passwords mpo ama Global Admins).
5. If locked out of Google Workspace (admin.google.com), fi ase yɛ Automated DNS no TXT/ .CNAME Admin Recovery Wizard immediately. Do not waste days trying consumer Gmail password resets. Go to admin.google.com, enter the locked Super Admin's email address, click "Forgot password?", step past the MFA prompts until the system offers Domain Verification recovery, OR go directly to Google's dedicated Workspace Admin Console Recovery Form (toolbox.googleapps.com/apps/recovery/form). Provide an accessible secondary email address and paste the unique google-site-verification=... TXT token into your domain's DNS zone.
6. Sɛ wɔatoto Microsoft 365 mu a (admin.microsoft.com), open a "Data Protection Team (DPT)" Severity-A Phone Ticket immediately. Unlike Google, Microsoft does not provide a public self-service web form to bypass MFA on an already-managed commercial tenant's sole Global Admin. You must call Microsoft Commercial Support (numbers listed in our Regional Table below), navigate the AI voice prompt by saying "Locked out of Global Administrator, zero other admins available, route to Data Protection Team", and obtain a 16-digit Data Protection Case Number. Have your DNS console open so you can immediately publish the verification TXT record the Data Protection engineer emails you.
7. Preserve your active billing credit card and never issue a bank chargeback while locked out. If your company's monthly Google Workspace or Microsoft 365 invoice hits your corporate credit card while you are locked out of the admin console, do not block the card or file a chargeback. Triggering a payment dishonor or chargeback on an active commercial tenant can cause automated anti-fraud systems to suspend all user mailboxes (550 5.1.1 User Unknown bounces) and schedule the tenant's SharePoint/Drive storage for permanent deletion within 30 to 90 days.

Decision tree: Regaining control of a locked Google Workspace or Microsoft 365 tenant¶

flowchart TD
    A["Total Lockout of Sole Super Admin (Google Workspace) or Global Admin (Microsoft 365)"] --> B{"Did you buy your licenses through a Reseller / MSP (GoDaddy, Pax8, Ingram, CDW)?"}
    B -->|"Yes: Bought via Reseller / CSP"| C["Fastest Fix (15 Mins): Call Reseller / MSP Support to Use Their Delegated Admin (GDAP) API to Reset Admin MFA or Promote a Second User"]
    B -->|"No: Bought Direct from Google or Microsoft"| D{"Which Cloud Platform is Locked?"}
    D -->|"1. Google Workspace (admin.google.com)"| E["Step 1: Try Automated Admin Recovery Flow at admin.google.com -> 'Try another way' -> 'Verify with Domain Host'"]
    E --> F{"Did Automated Flow Trigger DNS Challenge?"}
    F -->|"Yes"| G["Add Unique 'google-site-verification=...' TXT or CNAME Record at Domain Registrar; Google Resets Super Admin Within 24-72 Hrs"]
    F -->|"No / Form Loops"| H["Submit Support-Assisted Admin Recovery at toolbox.googleapps.com/apps/recovery/form + Promote Standard User via DNS TXT Proof"]
    D -->|"2. Microsoft 365 / Entra ID (admin.microsoft.com) ."| I{"So eyi yɛ ‘Shadow / Viral’ Ɔdansefo a Wɔnhwɛ So anaasɛ Ɔdansefo a Wɔhwɛ So wɔ Aguadi mu Nyinaa?"}
    I -->|"Shadow / Viral Tenant (Adwumayɛfoɔ a wɔde wɔn nsa ahyɛ aseɛ denam PowerBI/Teams free trial)"| J["Yɛ Self-Service 'Internal Admin Takeover' denam PowerShell / M365 Wizard a Fa DNS TXT Nhwehwɛmu a Ɛyɛ Ntɛm ara Di Dwuma"]
    I -->|"Full Commercial Managed Tenant (Sole Global Admin hweree MFA / ogyaw / owui) ."| K["Frɛ Microsoft Aguadi Mmoa -> Bisa 'Data Ahobammɔ Kuw (DPT)' Escalation -> Twa DNS TXT + Adwumayɛ wurayɛ Nhwehwɛmu"]

Google Workspace vs. Microsoft 365: Sɛnea tenant sanba nhyehyɛe no yɛ soronko¶

Bere a Google ne Microsoft nyinaa de wɔn ho to Authoritative DNS so TXT Verification de kyerɛ sɛ hena na ɔwɔ domain din a ɛbata cloud tenant no ho wɔ mmara kwan so no, wɔn administrative recovery workflows yɛ soronko koraa. Sɛ wunim lever ahorow a ɛwɔ platform biara so a, ɛbɛma woanya nna pii a wode bɛboa tekiti a ɛnyɛ hwee:

Playbook 1: Google Workspace Super Admin a wɔatoto mu a wɔregye (admin.google.com) .¶

Sɛ wɔato wo mu wɔ wo Google Workspace Super Admin akonta koro pɛ no mu a, sɛ́ ɛyɛ esiane sɛ wo fon a Google Authenticator wom no asɛe, wo FIDO2 hardware ahobammɔ safoa no yerae, IT adwumayɛfo bi a wafi hɔ sesaa asɛmfua no, anaasɛ woama ayɛ adwuma nti "Enforce 2-Step Verification" a woankyerɛw wo din wɔ admin akontaabu no mu kan no, yɛ anammɔn abiɛsa yi nnidiso nnidiso pɛpɛɛpɛ:

Ɔkwan A: Nea Ɛyɛ Automated admin.google.com Domain Verification Challenge (Ntɛmntɛm - Nnɔnhwerew 1 kosi 24) .¶

1. Bue Incognito / Private browser window wɔ kɔmputa a ɛwɔ wo ɔfese anaa fie Wi-Fi ntam nkitahodi a ɛyɛ daa so (Google asiane engine no nya IP subnets a wonim no yiye no nkontaa a ɛkorɔn) na kɔ https://admin.google.com na ɛyɛ.
2. Hyehyɛ Super Admin a wɔatoto mu no email address (admin@yourcompany.com) na klik Next so.
3. Sɛ wunim asɛmfua no nanso 2-Step Verification (MFA) asiw wo kwan a, hyɛ asɛmfua no, afei klik "Sɔ ɔkwan foforo hwɛ" wɔ 2FA screen no ase kosi sɛ wobɛbrɛ akwan a enni hɔ nyinaa. Sɛ wunnim asɛmfua no a, klik "Wo werɛ afi asɛmfua?" na klik "Sɔ ɔkwan foforo hwɛ" twa asɛm biara a enni hɔ ho.
4. Sɛ wɔwie standard recovery options nyinaa wɔ admin baako Google Workspace domain so wie a, Google automated recovery engine no de Domain Ownership Verification screen no kyerɛ:
5. Ɛka kyerɛ wo sɛ kyerɛw contact email address a wubetumi ahwɛ mprempren (te sɛ ankorankoro de @gmail.com address anaa adwumayɛfoɔ a wɔyɛ adwuma gyinapɛn email address).
6. Google de email a ɛwɔ ** soronko bi mena.CNAME anaasɛ TXT verification record** akwankyerɛ.
7. Kɔ wo domain registrar no DNS control panel (Cloudflare, Route 53, GoDaddy, Namecheap) mu na fa nea ɛyɛ pɛpɛɛpɛ no ka ho TXT anaasɛ CNAME kyerɛwtohɔ wɔ ntini no so (@) firi yourcompany.com a TTL a ɛyɛ sikani 300 (simma 5).
8. Pro Tip ma Cloudflare Users: Sɛ wode a CNAME nokwaredi kyerɛwtohɔ wɔ Cloudflare DNS mu, klik Orange Cloud ahyɛnsode no so na dan no Gray (DNS Only) na ɛyɛ. Sɛ Cloudflare no mununkum a ɛyɛ Orange (Proxied) no gyaw no ma ɛyɛ adwuma wɔ nokwaredi bi so CNAME, Cloudflare twa asɛmmisa no mu na ɛsan de Cloudflare proxy IPs ba mmom sen sɛ ɛbɛyɛ Google CNAME botae a wɔhwɛ kwan no, na ɛma nokwaredi no di nkogu bere biara.

Ɔkwan B: Admin Console Recovery Portal a Mmoa Boa (toolbox.googleapps.com/apps/recovery/form) .¶

Na sɛ automated login loop no ka kɛkɛ sɛ "Di wo domain administrator no nkitaho na woanya mmoa" (ironic bere a woyɛ domain administrator) anaa "Google antumi ankyerɛ sɛ saa akontaabu yi yɛ wo dea" nso ɛ?

Fa Google Adwumayɛbea Admin Akontaabu Recovery Portal a wɔatu ho ama, a wonni ho adanse no di dwuma: 1. Bue ** .https://toolbox.googleapps.com/apps/recovery/form** wɔ wo browser no mu. 2. Hyehyɛ wo Google Workspace domain din titiriw (e.g., . yourcompany.com) na wie CAPTCHA no. 3. Paw ntɛmpɛ a wobɛpaw no pɛpɛɛpɛ: - Bisa bisa password/2FA reset wɔ Super Admin akontaabu a wɔatoto mu no so; ANAASƐ - Wɔkamfo kyerɛ sɛ kan admin no yɛ ɔtamfo/owu a: Paw ɔkwan a wobɛfa so hyɛ daa ɔdefo akontaabu a ɛwɔ hɔ dedaw wɔ wo domain no so ho nkuran (you@yourcompany.com) de kɔ Super Administrator so. 4. Fa nkitahodi email address a ɛto so abien a ɛyɛ adwuma ma baabi a wubetumi anya tekiti ho nsɛm foforo. 5. Google nhyehyɛe no yɛ Ticket Reference Number ntɛm ara na ɛde email soronko bi mena wo ** .TXT kyerɛwtohɔ bo** (wɔahyehyɛ no te sɛ google-site-verification=rXOxyZ... anaasɛ google-workspace-recovery=...). 6. Tia saa asɛm no TXT kyerɛw wɔ wo domain no ɔmanfo DNS beae no, hwɛ tẽẽ fi terminal bi so sɛ ɛte ase wɔ wiase nyinaa denam mmirikatu so:

dig TXT yourcompany.com @8.8.8.8 +short

Playbook 2: Microsoft 365 a wɔatoto mu a wɔregye / Entra ID Wiase Nyinaa Sohwɛfo (admin.microsoft.com) .¶

Microsoft 365 lockouts yɛ den sene Google Workspace lockouts sɛ wunnim escalation channels pɔtee a, ɛfiri sɛ Microsoft front-line phone system no bɔ mmɔden sɛ ɛbɛka akyerɛ wɔn a wɔfrɛ no sɛ "kɔ Admin Center no mu nkɔbue support ticket", na ɛyɛ loop berɛ a wɔato wo mu afiri Admin Center.

mfiridwuma ne nhyehyɛe akwan anan a ɛyɛ pɛpɛɛpɛ a wobɛfa so afi Microsoft 365 Global Admin lockout mu ni:

Ɔkwan 1: "Secondary Admin a Wɔde Ahintaw" & . .onmicrosoft.com Bypass Check (Hwɛ Eyi Di Kan Wɔ Simma 5 Mu)¶

Ansa na wo ne Microsoft Data Protection Team no bɛtena asɛnka agua so no, hwɛ nneɛma abiɛsa a egye M365 adansifo a "wɔatoto mu" no ɔha biara mu nkyem 40 wɔ hɔ ara: 1. So SSO / Federation server a abubu (Okta, . Duo, . Cisco, . ADFS) to wo mu? - Bere a woreyɛ federate no yourcompany.com de kɔma obi a ɔto so abiɛsa a ɔde Identity Provider (IdP) na sɛ IdP adansedi krataa no twam anaasɛ ɛto wo mu, kɔ mu sɛ admin@yourcompany.com san de wo kɔ IdP a abubu no so. - The Instant Fix: Microsoft 365 tenant biara wɔ native cloud-only fallback domain a ɛba awiei wɔ @yourtenant.onmicrosoft.com na ɛyɛ. Kɔ https://entra.microsoft.com, korɔ admin@yourtenant.onmicrosoft.com (anaasɛ Global Admin dwumadie din biara a ɛwɔ hɔ wɔ .onmicrosoft.com domain), and sign in. .onmicrosoft.com accounts ALWAYS bypass third-party SAML/WS-Fed federation and authenticate straight against Microsoft Entra ID. 2. Does any IT staffer hold the "Privileged Authentication Administrator" role? - Many companies assign an IT manager the Privileged Authentication Administrator role without making them a full Global Admin. In Microsoft Entra ID, a Privileged Authentication Administrator has full legal permission to reset passwords AND revoke/re-require MFA for a Global Administrator. 3. Did you buy even ONE license through a CSP Reseller (GoDaddy, Pax8, Sherweb, Ingram, CDW, Rackspace)? - Look at your credit card statement. If your Microsoft 365 bill comes from a partner rather than directly from MICROSOFT*G..., call that partner's support desk right now. Even if they only sold you a single $6 Exchange Online license, if their GDAP (Granular Delegated Admin Privileges) relationship is active in your Partner Center, their engineer can reset your Global Admin's MFA in under 3 minutes.

Path 2: How to Reach the "Microsoft Data Protection Team (DPT)" When Zero Admins Can Log In¶

If you buy directly from Microsoft and your sole Global Administrator is completely locked out (lost Authenticator phone, or caught in a loop where Microsoft Authenticator asks you to approve a 2-digit number inside the Microsoft Authenticator app that you are currently trying to sign into), you must have a human Microsoft Data Protection Team (DPT) engineer perform a Tenant Ownership & DNS Verification Reset.

How to get past Microsoft's automated AI phone tree (IVR) in 2 minutes: 1. Call the regional Microsoft Commercial Support number (e.g., 1-800-865-9408 anaa ** .1-800-642-7676** in the US/Canada; see full global list below). 2. The automated voice bot is programmed to deflect standard password calls to aka.ms/sspr. Use these exact spoken phrases at each prompt: - Prompt 1 ("What are you calling about?"): Say clearly: "Global Administrator account lockout." - Prompt 2 ("Have you tried Self-Service Password Reset?"): Say: "Yes, I am the sole Global Administrator on a commercial business tenant and there are zero other administrators." - Prompt 3 ("What product?"): Say: "Microsoft 365 Business / Entra ID Commercial" and ask for "Transfer to the Data Protection Team." 3. What if the phone tree still hangs up on you? Use the "Trial Tenant Bridge Trick": - This is the well-known sysadmin emergency bypass when Microsoft's phone IVR refuses to connect you: Go to microsoft.com/microsoft-365/business, spin up a free 30-day Trial Microsoft 365 Tenant using a throwaway temprescue-[yourcompany].onmicrosoft.com name (takes 3 minutes, no charge for 30 days). - Log into admin.microsoft.com inside that temporary trial tenant, click Support > Help & Support in the bottom right corner, and open a Severity-A Admin Support Ticket stating: > "URGENT DATA PROTECTION TEAM ESCALATION: I am opening this ticket from a temporary bridge tenant because I am the sole Global Administrator of production tenant [YOURREALDOMAIN.COM / Tenant ID] and I am completely locked out of MFA with zero other Global Admins. Please transfer this ticket to the Microsoft Data Protection Team immediately."

Path 3: Passing the Microsoft Data Protection Team (DPT) Verification Audit & DNS TXT Challenge¶

Once a Microsoft Data Protection Team engineer claims your case, they follow a strict zero-trust security protocol before they will strip MFA from your Global Admin or promote a new user: 1. Business & Billing Ownership Proof: Keep these four items ready in a folder so you can read or upload them on the first call: - Your Domain Name (yourcompany.com) and onmicrosoft.com Tenant Name (find your exact Tenant ID GUID anytime without logging in by visiting https://login.microsoftonline.com/yourcompany.com/v2.0/.well-known/openid-configuration); - The last 4 digits and expiration date of the credit card on file for Microsoft billing (or recent Microsoft Commercial Invoice numbers G0...); - The exact billing street address and phone number listed on the tenant's Organization Profile; and - Official Articles of Incorporation / Business License / Utility Bill if the former admin was a rogue employee who put their own cell phone on the profile. 2. The Authoritative DNS TXT Record Proof: - The Data Protection engineer will give you a unique verification string (such as MS=ms12345678 or a case-specific token) to add as a TXT record at the root (@) firi yourcompany.com. - Once nslookup -type=TXT yourcompany.com confirms the record is live, the DPT engineer resets the Global Admin's Multi-Factor Authentication registration (Require Re-Register MFA) and issues a temporary password so you can log in and enroll a new Authenticator app and FIDO2 key.

Path 4: Self-Service "Internal Admin Takeover" (If Your Domain Is Locked in an "Unmanaged / Viral" Shadow Tenant)¶

What if you are trying to set up Microsoft 365 for yourcompany.com, and Microsoft displays the error: "yourcompany.com is already being used with another Microsoft 365 organization", because three years ago a random employee signed up for a free Power BI, Microsoft Teams Exploratory, or Fabric self-service account using their @yourcompany.com work email? - Because that "shadow" tenant has zero Global Administrators (it is an Unmanaged Viral Tenant), you do not need to call Microsoft Support at all. - You can execute an instant Internal Admin Takeover: 1. Sign in to Microsoft 365 using any active @yourcompany.com user account that exists in that viral tenant (or create a free Power BI self-service account with admin@yourcompany.com). 2. Navigate to https://portal.office.com/admintakeover (or run the Microsoft Graph PowerShell takeover cmdlet). 3. Microsoft immediately displays a TXT verification code (MS=msXXXXXXXX) na ɛyɛ. 4. Paste that TXT record into your domain registrar's DNS, click Verify, and Microsoft instantly promotes you to full Global Administrator of the entire yourcompany.com tenant in 60 seconds.

Step-by-step post-recovery security audit (If the lockout was caused by a hostile ex-admin or compromise)¶

If your lockout happened because a disgruntled former IT administrator, terminated contractor, or external attacker deliberately stripped your privileges or hijacked the Super/Global Admin account, merely regaining login access is not enough. A hostile actor who had Super Admin or Global Admin access for even 15 minutes often plants "persistence backdoors" so they can silently regain control next week even after you change the main password.

Execute this 5-point persistence purge within the first 30 minutes of logging back into your recovered console:

1. Audit Newly Created Service Principals, Enterprise OAuth Apps, and App Passwords:
2. In Microsoft Entra ID (entra.microsoft.com): Go to Identity > Applications > Enterprise applications na App registrations. Sort by Created Date. A sophisticated rogue admin will create a hidden App Registration granted RoleManagement.ReadWrite.Directory anaa ** .Directory.ReadWrite.All** Microsoft Graph API application permissions with a 24-month Client Secret. Even if you delete the rogue admin's user account, their Python script can use that Client Secret from home to promote a new backdoor user to Global Admin tonight. Delete any unrecognized App Registrations or Client Secrets immediately.
3. In Google Workspace (admin.google.com): Go to Security > Access and data control > API controls > Manage Domain Wide Delegation. Inspect every Google Cloud Service Account Client ID that has been granted Domain-Wide Delegation (https://www.googleapis.com/auth/admin.directory.user) and delete any unrecognized Google Cloud projects or OAuth tokens.
4. Hwɛ Ɔhokafo Abusuabɔ (GDAP / . DAP) ne Cross-Tenant Nsiesiei a Wɔde Kɔ:
5. Wɔ Microsoft 365 Admin Center mu no, kɔ Settings > Partner relationships. Hwɛ sɛ adwumayɛfo a wɔyɛ asisifo no amfa wɔn ankasa Microsoft Partner Network (MPN) akontaabu sɛ Cloud Solution Provider a wɔde ahyɛ ne nsa ne GDAP Wiase Nyinaa Admin hokwan ahorow.
6. Wɔ Microsoft Entra ID mu no, hwɛ External Identities > Cross-tenant access settings na Users > All users (a wɔde yiyi mu ma User type == Guest ne Directory Roles a wɔde ama) de ahwɛ sɛ abɔnten so biara nni hɔ @gmail.com anaasɛ @outlook.com wɔde Global Administrator anaa Privileged Role Administrator dwumadie no maa ahɔhoɔ dwumadie no komm.
7. Purge Hidden Inbound/Outbound Mail Routing Mmara ne Auto-Forwarding:
8. Hwɛ Exchange Admin Center > Mail flow > Rules (wɔ Microsoft 365 mu) anaasɛ Apps > Google Workspace > Gmail > Routing (wɔ Google Workspace) ma tenant-wide transport mmara biara a ɛyɛ komm BCC anaasɛ dannan adwumayɛfo email, password-reset links, anaa wire-transfer invoices kɔ abɔnten address so.
9. Twe Active Refresh Tokens ne Session Cookies Nyinaa mu Tenant-Wide:
10. Sɛ wosakra ɔdefo bi asɛmfua wɔ mununkum tebea mu a, ɛnyɛ bere nyinaa na ekum OAuth refresh token a ɛyɛ adwuma anaa Continuous Access Evaluation (CAE) nhyiam ahorow wɔ laptop ahorow a wɔagye atom dedaw so. Klik "Revoke sessions / Sign out of all sessions" pefee wɔ admin akontaabu a wɔahaw no so na dannan krbtgt / Azure AD SSO Kerberos decryption safoa sɛ Azure AD Connect / Entra Connect hybrid sync no wɔde di dwuma wɔ beae hɔ.
11. Ma "Admin Approval / Multi-Party Approval" ne Kɔkɔbɔ wɔ Dwumadie Dwumadie ho nyɛ adwuma:
12. Hyehyɛ email ne SMS webhook kɔkɔbɔ a ɛba ntɛm ara wɔ Google Workspace Admin Audit Logs anaa Microsoft Entra ID Privileged Identity Management (PIM) sɛnea ɛbɛyɛ a Super/Global Admin biara benya out-of-band kɔkɔbɔ ntɛm ara bere biara a wɔde ɔdefo bi bɛka adwumayɛfo dwumadi bi ho anaasɛ bere biara a wɔbɛsesa MFA nhyehyɛe no.

Mpɔtam hɔ ntɛmpɛ nɔma ne adwumakuw no nhyehyɛe ahorow¶

Nsɛm a wɔtaa bisa¶

Dɛn nti na ɛtɔ da bi a Microsoft Data Protection Team no gye nnafua 5 kosi 10 ansa na wɔabue Global Admin bi bere a metumi akyerɛ sɛ mewɔ DNS no mprempren?¶

Esiane sɛ Microsoft 365 a wɔde di gua no taa kura dɔla ɔpepepem pii wɔ adwene mu agyapade, sikakorabea nhama tumidi, ne HIPAA/GDPR data mu nti, asetra mu mfiridwuma ntuafo taa bɔ mmɔden sɛ wɔbɛdaadaa mmoa adwumayɛfo ma wɔasan de Global Admin bi MFA asi hɔ. Ne saa nti, Microsoft de anohyeto ma Global Admin MFA resets a wɔannye ho adanse no wɔ Tier-3 unit ketewa bi a ɛyɛ soronko a wɔfrɛ no **Data Protection Team (`DPT`)** na ɛyɛ. Bere a woretwɛn wɔ DPT ntonto no mu: (1) san frɛ pɛnkoro da biara fa wo **16-digit Case Number** ho asɛm, (2) bisa front-line agent no sɛ ɔmfa tekiti no nhyɛ tekiti no agyirae sɛ **"Business Critical - Total Admin Lockout with Zero Backup Admins (Severity A)"**, ne (3) sɛ wowɔ Microsoft Account Executive, Cloud Solution Provider (`CSP`), anaa Unified Support apam, bisa wɔn sɛ wɔmfa emu **"CritSit" (Critical Situation)** escalation mmra wo case nɔma so, a ɛtaa tew DPT mmuae bere so kɔ fam kodu nnɔnhwerew 24.

Na sɛ kan IT adwumayɛfoɔ a ɔyɛ ɔkwasea no too yɛn mu wɔ Microsoft 365/Google Workspace NE yɛn Domain Registrar (GoDaddy / Cloudflare) NO NYINAA no mu nso ɛ?¶

Sɛ odwumayɛni anaa adwumayɛfo a wɔagyae adwuma no kyerɛw ne din a `yourcompany.com` wɔ wɔn ankasa login ase anaasɛ wɔato wo mu wɔ wo Domain Registrar (GoDaddy, Namecheap, Cloudflare, Network Solutions) mu, **ɛsɛ sɛ wosan nya Domain Registrar akontaabu no kan**, efisɛ wuntumi ntintim Google/Microsoft DNS no `TXT` kyerɛwtohɔ a enni registrar kwan so. Ɔkyerɛwfo biara a ICANN agye atom no wɔ **Domain Ownership / Account Recovery Dispute Portal** (sɛ nhwɛso no, GoDaddy deɛ) a wɔatu ne ho ama `Account Recovery & Change of Update Request`). Fa: (1) wo adwumakuw no **Articles of Incorporation / IRS EIN Letter / Business Registration**, (2) wo **Aban Mfonini ID** no bi sɛ adwumakuw no panyin, ne (3) **adwumakuw no credit card anaa sikakorabea nkrataa** a ɛkyerɛ sɛ wo adwumakuw no tuaa domain dinkyerɛw ne foforoyɛ ho ka. Ɔkyerɛwfo no de domain no bɛkɔ adwumakuw akontaabu foforo mu wɔ nnɔnhwerew 48 kosi 96 mu, na ama woatumi atintim DNS no `TXT` record and take back Google Workspace or Microsoft 365 immediately after.

How do I find my Microsoft Entra ID "Tenant ID" (GUID) if every single person is locked out of the portal?¶

When you call Microsoft's Data Protection Team, having your exact 36-character **Tenant ID GUID** (`xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`) speeds up ticket routing dramatically. Even if nobody in your company can log in, Microsoft's OpenID Connect metadata endpoint is public for every domain in the world. Open any web browser and navigate to: `https://login.microsoftonline.com/YOURDOMAIN.COM/v2.0/.well-known/openid-configuration` (replacing `YOURDOMAIN.COM` ne wo adwumakuw no domain din). Wɔ JSON nkyerɛwee a ɛbɛpue wɔ screen so no, hwɛ URL a edi kan koraa wɔ akyi `"token_endpoint"`: the 36-character alphanumeric code right after `login.microsoftonline.com/` is your exact **Microsoft Entra Tenant ID**.

Will resetting the Global Admin or Super Admin via DNS TXT verification delete any emails, OneDrive files, or Google Drive documents?¶

No. Neither the Google Workspace DNS Admin Recovery flow nor a Microsoft Data Protection Team MFA/password reset touches a single byte of user mailbox data, SharePoint sites, OneDrive folders, Teams chats, or Google Drive documents. In fact, if you choose the option to **promote an existing standard employee account to Super Admin / Global Admin** (rather than resetting the departed employee's password), the departed employee's mailbox and files remain completely untouched and preserved for legal discovery while your newly promoted admin takes full control of the console.

What if we set up a Microsoft Entra Conditional Access policy that accidentally blocked ALL users (including Global Admins) by requiring a compliant Intune device or specific IP address?¶

This is called a **Conditional Access Self-Lockout**, such as when an admin creates a Conditional Access policy targeting `"All Users"` na `"All Cloud Apps"` with a control that cannot be satisfied (like requiring a Hybrid Azure AD Joined device or an expired VPN IP range) and forgets to check the `"Exclude Emergency Access Accounts"` box. Because the policy blocks every admin at login, even knowing your password and having your working MFA phone won't let you in. Your only rescue path is to call **Microsoft Commercial Support**, escalate to the **Data Protection Team**, pass the DNS `TXT` ownership verification, and ask the DPT engineer to run their internal backend tool to **disable the offending Conditional Access policy** on your tenant.

Akwankyerɛ ahorow a ɛfa ho¶

• Domain name hijacking, expired DNS, and website takeover
• Cloud account ban: Google, Apple, and Microsoft lockout appeals
• Two-factor authentication phone number recycled by carrier and SMS lockout
• Password manager lockout, master password loss, and vault recovery

Fibea ne aban akwankyerɛ¶

• Google Workspace Administrator Help & Security Documentation: Recover Administrator Access to Your Google Workspace Account (admin.google.com), Support-Assisted DNS TXT/ .CNAME Verification (toolbox.googleapps.com/apps/recovery/form), and Best Practices for Super Administrator Break-Glass Accounts.
• Microsoft Learn (Microsoft Entra ID / Microsoft 365 Documentation): Manage Emergency Access Accounts in Microsoft Entra ID, Perform an Internal Admin Takeover on an Unmanaged Directory via DNS TXT Verification, and Global Administrator MFA Lockout Escalation via the Data Protection Team.
• Cybersecurity and Infrastructure Security Agency (CISA, United States): Cloud Security Technical Reference Architecture and CISA ScubaGear Baselines for Microsoft 365 and Google Workspace Tenant Resilience.
• National Institute of Standards and Technology (NIST): Special Publication 800-63B (Digital Identity Guidelines: Authentication and Lifecycle Management, Multi-Factor Authenticator Recovery).
• Internet Corporation for Assigned Names and Numbers (ICANN): Registrant Rights and Responsibilities and Domain Name Control Verification Protocols.