First, a little background:
I'm a senior web dev working for a marketing company, and we have a client who had a third party create a dashboard in PowerBI that he wanted embedded on his website. However, in order to embed something from PowerBI in another site, you need to turn on embed permissions, and to do that, you have to be an admin for your domain.
Yesterday, I performed the Internal Admin Takeover process described here. I logged in with our client's credentials, clicked the "Yes, I want to be the admin" option, added the required DNS record, and then followed the "Okay, I've added the record" link. It seemed to indicate that the process had been successful, but then asked me to log back in. I attempted to log in, and the login process asked me to use the Microsoft Authenticator app to approve the login. Prior to the takeover, I didn't need a 2fa code or any other second-factor approval, and to the best of the client's recollection, he hadn't ever needed one either.
We got the Authenticator app and (apparently successfully) signed in on it, but there was never a notification from PowerBI's login attempt. You can also have PowerBI ask for a code instead of approving the login within Authenticator, so we tried that. Authenticator gives an 8-digit code, but PowerBI wanted a 6-digit code. It turns out that you have to set up Authenitcator via a QR code instead, as a more generic second factor, in order to get the 6-digit code.
This is when I learned that there are now two Microsoft accounts with the same email address for logging in -- one that it considers a Personal account, and one that's tied to Entra / Azure AD / "Work or school". I am unsure whether this second account even EXISTED prior to the admin takeover, though I think it probably DID, but it did NOT have 2fa turned on -- it was somehow automatically turned on as part of the takeover process. When we were able to log into Authenticator, it was for the Personal account, but PowerBI needs the Entra account.
The problem is that I can't log into Authenticator with the Entra account, because it requires the second factor provided by... Authenticator. There's no option that I can find to email or text a code instead of using Authenticator, and there's no way to use Authenticator without logging in. The codes for the Personal account don't work as a second factor for the Entra account, and the login approval notification never shows because, well, we're logged into the Personal account.
As far as I can tell, I can't contact Microsoft support, because you have to be logged in to contact support for business products, and I can't log into the account that's attached to business products.
So: how do I contact support or somehow recover this account? The client is willing to handle it too, but we still can't find any way to actually DO that -- there's no indication of anything that can be done on the login screens. The only advice there is either a link to "Common problems with two-step verification", which has no follow-up steps when that doesn't work, or, after a 2fa attempt fails, info to give "to your administrator", who, as best as I can tell, is either the client's user or maybe Microsoft?
