[Microsoft Partner Center] Steps to remove user access restrictions

When there is only one Global Administrator and that account is blocked from Partner Center or the tenant by Conditional Access or similar restrictions, the situation is treated as a tenant lockout and must be resolved with the tenant’s Global Administrator working directly with Microsoft.

Key points and steps to explain:

1. Only one Global Administrator exists
   • Partner Center user management requires a Global admin for the company to add or remove users and assign roles.
   • If there is only one Global admin and that account is blocked, no one else can change Conditional Access, MFA, or admin roles from within the tenant or Partner Center.
2. Account is blocked by Conditional Access or similar restrictions
   • The message “Access restricted due to conditional access policy” indicates that an Azure (Entra) Conditional Access policy is preventing sign-in to Partner Center or the tenant.
   • Partner Center only enforces the organization’s Conditional Access policies; Microsoft cannot alter or override those policies from Partner Center.
   • If self-correction (for example, updating device software or meeting policy requirements) is not possible, the Azure (Entra) administrator must adjust or remove the blocking policy. In this scenario, that administrator is the same locked-out Global admin, so self-service recovery is not possible.
3. Access is needed to manage Partner Center and driver signing
   • Without the Global admin regaining access to the tenant, it is not possible to:
     • Sign in to Partner Center to manage users, roles, or tenants.
     • Manage Partner Center workspaces required for activities such as driver signing.
4. Required next steps (Data Protection / Microsoft Support path)
   • Because there is only one Global admin and that account is locked by Conditional Access/MFA and cannot sign in, this is a tenant lockout scenario where Microsoft must work directly with the tenant’s Global Administrator:
     • The Global admin (or an authorized representative) must contact Microsoft support by phone using the business support numbers. See: “Find Microsoft 365 for business support phone numbers by country or region.”
     • Clearly state that:
       • This is a business/organization account.
       • There is only one Global Administrator.
       • That Global admin is locked out due to Conditional Access/MFA and cannot access Partner Center or the tenant.
       • Access is required to administer Partner Center and associated services (such as driver signing).
   • The frontline support agent will route the case to the Microsoft Data Protection / Tenant Recovery team, who have tools and processes to verify identity and restore access for the sole Global admin.
   • If the tenant was obtained through a partner/reseller and the Global admin cannot open a service request, the reseller’s support organization can open a service request on behalf of the customer.
5. No workaround from Partner Center side
   • Partner Center cannot bypass Conditional Access or tenant lockout.
   • Removing or changing tenants or roles in Partner Center requires a Global admin who can sign in; this is not possible until the Data Protection team restores access to the locked Global admin account.

Summarized explanation to provide:

• There is only one Global Administrator on the tenant.
• That Global admin account is blocked from Partner Center and/or the tenant by Conditional Access or MFA, so no one can change policies or roles from within the environment.
• Access is required to manage Partner Center and driver signing, but Partner Center cannot override Conditional Access.
• The only resolution path is to contact Microsoft support (business support phone) so the case can be escalated to the Data Protection/Tenant Recovery team, who will verify identity and help restore access for the Global admin.

References:

• Pages, capabilities, offers, or benefits aren't appearing in Partner Center
• Preventing tenant lockouts
• Find and become the Global admin
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• Global Admin Locked out - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• Microsoft authenticator sending me into a spiral - Microsoft Q&A