What to do if you lose access to your Google or Microsoft admin account

Go to the Google Workspace sign-in page at accounts.google.com and enter your admin email address.

Click "Try another way" when prompted for your 2FA code. Google offers whichever other verification methods you set up, such as backup codes or a code sent to your recovery phone. Try each one.

If you have backup codes, enter one now. If you set up backup codes when you enabled 2FA, they should be stored in your password manager or a secure document. This is the fastest path.

If you have no backup codes and no recovery method, ask another super admin in your organization first. They can usually sort out a 2FA lockout faster than recovery can. If there isn't one, proceed to the domain verification recovery below.

Go to accounts.google.com/signin/recovery and enter your admin email address. If you added a recovery phone number or email address to the account, Google sends a verification code there and you can reset the password.

If Google's automated recovery doesn't work, the recovery wizard asks you to verify your domain instead. Google's own guide to this route is Recovering administrator access to your account.

Verify domain ownership. Google asks you to add a CNAME record to your domain's DNS settings. Log in to your domain registrar (the company you registered your domain with, see how to find where your domain is registered), and add the record Google provides. If your hosting provider is separate from your registrar, Google's instruction is to add the record with the hosting provider.

Wait a few minutes before continuing. Google's advice is to pause before clicking Next, so the new record has time to be visible. That makes an immediate password reset more likely. See DNS propagation explained.

Return to the recovery wizard and click Next. If Google finds the record, you can set a new password. If it doesn't, the wizard falls back to a verification code and some questions about your account, and you'll get a password reset link by email.

Check whether another super admin exists in your organization. Google recommends having at least two super admins so that one can reset the other's password. Ask any colleague who might have admin access to check their account.

If no other admin exists, use the domain verification recovery process above to regain access via domain ownership proof.

Once you regain access, immediately make a second super admin as a backup. In the Google Admin console, go to Directory → Users, click the trusted person's name, then click Admin roles and privileges. Click Super Admin, set its slider to Assigned, and click Save. It usually takes effect in a few minutes, but can take up to 24 hours. See adding a user if you need to create the account first.

Go to the Microsoft sign-in page (for example, login.microsoftonline.com), type your admin user name, and select Next.

Select Forgot password and follow the steps.

Verify your identity. The wizard uses the alternate email address or mobile number registered on your account to verify you.

Reset your password. Once verified, you'll be prompted to create a new password.

Check for another Global Administrator. In Microsoft 365, only another Global Administrator or a Privileged Authentication Administrator can reset a Global Administrator's password. Ask a colleague with one of those roles to sign in to the Microsoft 365 admin center at admin.microsoft.com and reset your account.

If you are the only Global Administrator, you'll need to contact Microsoft support directly. You can't raise a request from inside an admin center you can't sign in to, so phone them. Microsoft's support numbers have changed, so use the number on Microsoft's own country list rather than one you have written down.

Microsoft will need to confirm you're entitled to the account. Have your billing and organization details ready.

Once access is restored, set up a second Global Administrator account immediately. Go to the admin center, choose Users, select Active users, and assign the Global Administrator role to a trusted backup account. Microsoft also recommends having someone with the Privileged Authentication Administrator role, who can recover a locked-out admin.

Check whether another Global Administrator exists. They can sign in and reassign the admin role to a current employee.

If no other Global Administrator exists, contact Microsoft support using the steps above to verify ownership and regain access.

Consider blocking the former employee's account while you work through this. A Global Admin can do this from the admin center. Microsoft warns blocking can take up to 24 hours to take effect, so to stop access straight away, also reset their password and sign them out of all sessions. See removing a user safely.

Always have at least two Global/Super Admins. One can be a shared account like admin@yourbusiness.com; keep its credentials in your password manager.

Set up recovery phone and email on every admin account. In Google Workspace, go to the Admin console → Directory → Users → the person → Security → Recovery information. In Microsoft 365, make sure each admin has registered an alternate email address or mobile number for password reset.

Save 2FA backup codes in your password manager the moment you enable 2FA. See setting up two-factor authentication.

Give us delegated admin access. This gives us a safe back-door for exactly these emergencies. See give us Google Workspace admin access and give us Microsoft 365 admin access.