Locked out of my M365 Admin account after entra ID p2 license expired and PIM autouninstalled

Matt Bryan 0 Reputation points
2026-03-12T00:29:47.8333333+00:00

My EntraID P2 licenses expired on 3/1. I was able to sign n on 3/3 and PIM to get admin rights without issues, without even realizing that license expired. fast forward to 3/10 and i try to sign in again. get into PIM portal but all PIM activation options are missing. I go to my disty and renew the EntraID P2 license. Today 3/11 i go in and still no PIM activation options. I logged in with my alt account that was also PIM but had security admin permanently assigned. Checked the Audit logs in Entra and see that Azure AD PIM performed the following action on 3/10 -
Activity Type: Tenant offboarded from PIM | LicenseStatus: Deleted | AuditType: OffboardTenant

and now i cannot get back into my tenant to do any admin functions.

How do i recover from this?

Microsoft Security | Microsoft Entra | Microsoft Entra ID

1 answer

Sort by: Newest
Most helpful Newest Oldest

  1. AI answer

    2026-03-12T00:30:00.8066667+00:00

    Because the tenant was offboarded from PIM when the Microsoft Entra ID P2 licenses expired and there’s now no way to activate privileged roles, recovery requires direct Microsoft support intervention rather than a self-service fix.

    The supported path to regain access in a lockout scenario where no admin can elevate or manage roles is to open a support ticket and have the Microsoft Data Protection team restore access to an administrator account for the tenant. They have specific tools and processes to verify identity and re-enable admin access when:

    • There is effectively no working global admin or privileged role available, and
    • License or MFA/role issues prevent self-service recovery.

    If there is truly no other account with permanent Global Administrator or equivalent rights that can still sign in and manage roles, proceed as follows:

    1. Contact Microsoft support by phone and request a service ticket for a tenant lockout / admin access recovery scenario. Use the global customer service phone numbers listed under support.
    2. Clearly state that:
      • The tenant was offboarded from PIM due to license expiration.
      • All administrative access was dependent on PIM-eligible roles.
      • After license renewal, PIM options are gone and no admin functions are available.
      • There is no other working global admin in the tenant.
    3. Work with the Data Protection team to verify ownership of the tenant and have them:
      • Restore or assign a Global Administrator (or equivalent) role to a specified account, or
      • Re-enable access in a way that allows reconfiguration of PIM and roles.

    If the tenant is associated with a partner/reseller and direct ticket creation is blocked, ask the partner to open a support request on behalf of the organization.

    Once access is restored, reconfigure PIM and ensure that at least one break-glass admin account has a permanent Global Administrator assignment that does not depend on PIM or expiring licenses.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.