(ASAP/URGENT) CONDITIONAL ACCESS LOCKOUT

Follow these steps immediately to restore access and prevent future lockouts.

1. Try to recover access using another admin
   • If there is any other Global Administrator in the tenant (including a break-glass/emergency account), have that admin:
     1. Sign in to the Azure portal / Microsoft Entra admin center.
     2. Go to Microsoft Entra ID → Security → Conditional Access.
     3. Identify the CA policy causing the MFA loop (likely targeting All users and key resources like Azure portal, Microsoft 365, etc.).
     4. Disable the problematic policy or edit it to:
        • Exclude at least one admin account from the policy, and
        • Relax the control that is causing the loop (for example, overly strict MFA or device requirements).
     5. Save changes and have users sign out and sign back in.
2. If all admins are locked out
   • This is a tenant lockout scenario. When no admin can sign in to fix Conditional Access, Microsoft support must intervene.
   • Open a support request with Microsoft so they can review and update the Conditional Access policies that are blocking access:
     • Follow the process in submit a support request from any tenant where an admin account can still sign in (for example, another customer tenant you manage, or a temporary/trial tenant as described in the Q&A examples in the context).
     • Clearly state that:
       • This is a Conditional Access lockout.
       • All admins and users in the affected tenant are blocked by a CA policy (MFA loop).
       • You need Data Protection / Tenant Recovery assistance to adjust or disable the blocking CA policy.
   • If you cannot open a ticket from any portal, call Microsoft support using the regional Customer service phone numbers - Microsoft Support and request escalation to the Data Protection team for Conditional Access lockout, as shown in the Q&A examples.
3. While working with Microsoft support
   • Be ready to provide:
     • The affected tenant name and primary domain.
     • The admin UPNs that are locked out.
     • Description that a CA policy targeting all users / all resources is enforcing MFA and causing a loop for all accounts.
   • Microsoft support will verify identity and then modify or disable the blocking Conditional Access policy so admins can sign in again.
4. After access is restored – harden and prevent future lockouts
   • Implement emergency access (“break-glass”) accounts:
     • Create at least two cloud-only emergency access accounts with the Global Administrator role.
     • Store their credentials securely.
     • Exclude these accounts from all Conditional Access policies, especially those requiring MFA or device compliance.
   • Review Conditional Access design:
     • Avoid policies that apply Block access or strict controls (like “require compliant device” or “require hybrid joined device”) to All users / All resources without exclusions.
     • Test new CA policies in Report-only mode first, then roll out gradually.
   • For service accounts and service principals, use Conditional Access for workload identities and/or managed identities, and exclude them from user-scoped CA policies.

These steps will get the tenant unlocked (via another admin or Microsoft support) and then ensure future CA changes do not take the entire tenant offline.

References:

• Troubleshoot sign-in problems with Conditional Access
• How to investigate the Conditional Access block policy alert
• Create a resilient access control management strategy with Microsoft Entra ID
• Require multifactor authentication for all users
• Require MFA for Azure management
• Mandatory multifactor authentication for Azure and admin portals
• Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• Global Admin Locked out - Microsoft Q&A
• Microsoft authenticator sending me into a spiral - Microsoft Q&A