Locked Out of Azure Tenant Due to Conditional Access

Pratibha Verma 0 Reputation points
2026-03-28T08:03:20.11+00:00

Hello,

I am the sole Global Administrator of a newly created Azure tenant under a free trial subscription. While configuring Conditional Access policies, I mistakenly applied settings that now block all sign-in attempts, including my own admin account.

As a result, I am completely locked out of the tenant. Password resets do not resolve the issue because the Conditional Access policies enforce MFA and block access after authentication.

I would appreciate assistance withnRecovering administrative access to the tenant, if possible

I can provide any verification details required to confirm ownership of the tenant.

Thank you.

Community Center | Not monitored
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-03-28T08:04:06.77+00:00

    Because the Conditional Access policies are blocking all sign-ins and there is only one Global Administrator, recovery must go through Microsoft support and the Data Protection/Tenant Recovery process.

    Use the following paths depending on what is still accessible:

    1. If any other admin account can still sign in (even with limited access)
      • Have that admin:
        1. Sign in to the Azure portal and go to Microsoft Entra ID.
        2. Open Security → Conditional Access.
        3. Disable or edit the Conditional Access policy that is blocking access, or exclude the affected admin account from that policy.
      • If the issue is specifically MFA preventing sign-in and another Global Admin exists, that admin can reset MFA registration for the locked-out account so it can re-register:
        1. In Microsoft Entra ID, go to Users.
        2. Select the affected user.
        3. Go to Authentication methods and select Require re-register multifactor authentication.
    2. If no other admin can sign in (sole Global Admin locked out)
      • This is effectively a tenant lockout scenario. Conditional Access cannot be fixed self-service because no admin can reach the portal.
      • Recovery requires Microsoft support/Data Protection to adjust the blocking Conditional Access policies after verifying ownership.
      • Take these steps:
        1. Use the global or regional support phone numbers listed under Microsoft 365/Azure support (for example, via the contacts referenced in the documentation such as Get support - Microsoft 365 admin or the global support phone numbers mentioned for tenant recovery).
        2. When prompted by the automated system or support agent, clearly state that this is a tenant lockout / Conditional Access lockout and that there is only one Global Administrator.
        3. Ask to be routed to the Data Protection or Tenant Recovery team.
        4. Provide all requested verification details (tenant domain, admin UPN, subscription details, business information, and any sign-in error codes like AADSTS53003 / BlockedByConditionalAccess if available).
      • Microsoft support will review and, after confirming ownership, update or disable the Conditional Access policies that prevent access so that the Global Admin can sign in again.
    3. If unable to open a ticket from the locked tenant
      • If direct phone support is difficult to reach, one workaround (described in similar lockout cases) is to:
        1. Create a separate temporary Microsoft 365/Azure trial tenant.
        2. Sign in to that new tenant’s admin portal.
        3. From there, open a support request explicitly stating that the issue is with a different existing tenant where the Global Admin is locked out by Conditional Access.
        4. Provide the locked tenant’s domain, admin UPN, and error details so support can engage the Data Protection team for that tenant.
      • This temporary tenant is only for contacting support; it does not give access to the locked tenant’s resources.
    4. Future prevention once access is restored
      • Configure at least two Global Admin accounts with different credentials and MFA methods.
      • Create emergency access (break-glass) accounts that are excluded from all Conditional Access policies, with strong passwords and monitored sign-in activity.
      • Avoid blanket Conditional Access policies that apply to all admins; always test policies and ensure break-glass accounts are excluded before enforcing.

    These steps align with Microsoft’s documented guidance for Conditional Access lockouts and tenant lockout prevention and rely on Microsoft support/Data Protection to recover a tenant when the sole Global Admin is blocked by Conditional Access.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.