Additional sign-in methods are required to access this resource. Contact your administrator to enable these methods. All Global Admin accounts is blocked by Conditional Access policy

The sign-in is being blocked by a Conditional Access policy (error AADSTS53003) that requires additional sign-in methods or conditions which your current session does not satisfy. All Global Admin accounts are also blocked, so no one can modify the policy from within the tenant.

To resolve this situation:

1. Confirm Conditional Access as the cause
   • In Microsoft Entra sign-in logs for the failed sign-in (App: Microsoft Flow Service / Microsoft Flow Portal), check the Conditional Access tab and the error code AADSTS53003 to verify that a Conditional Access policy is blocking access.
   • Also review Service dependencies: the Flow portal may be calling other resources (for example, SharePoint, Exchange). A policy targeting one of these resources can block Flow even if Flow itself is not directly targeted.
2. Understand the likely policy misconfiguration
   • The message “Additional sign-in methods are required to access this resource” and error AADSTS53003 indicate a Conditional Access grant control (for example, MFA, compliant device, Terms of Use, specific authentication flows) is not satisfied.
   • Policies scoped to all users / all cloud apps / all device platforms with controls like Block access, Require device to be marked as compliant, or Require Hybrid Microsoft Entra joined device can easily lock out the entire organization, including admins.
   • For Power Automate specifically, adding Terms of Use to a Conditional Access policy after flows are already running can break existing Flow connections and cause AADSTS53003 for the Microsoft Flow Service.
3. If any admin is still able to sign in
   • Have that admin:
     1. Go to the Microsoft Entra admin center → Identity → Protection → Conditional Access.
     2. Identify the policy that is blocking access (using the sign-in logs’ Conditional Access tab and the affected app/resource).
     3. Temporarily disable or relax the policy (for example, remove “all users” or “all cloud apps”, or remove the problematic grant control) so that Global Admins can sign in again.
     4. Reconfigure the policy following best practices, including:
        • Avoid “Block access” or strict device requirements on all users / all resources.
        • Exclude emergency access (break-glass) accounts and critical service accounts/service principals from such policies.
4. If all Global Admins are locked out (your case)
   • When no administrator can sign in to update Conditional Access policies, the only supported path is to involve Microsoft support:
     1. Follow the guidance under “What to do if you're locked out”: if no admin can update the policy, submit a support request so Microsoft support can review and update the Conditional Access policies that prevent access.
     2. This escalation typically goes to the Data Protection / Tenant Recovery team, who will verify tenant ownership and then adjust or disable the blocking Conditional Access policy so that an admin can regain access.
5. Prevent future lockouts
   • After access is restored:
     • Create and maintain at least one emergency access (break-glass) account that is excluded from all Conditional Access policies.
     • Exclude critical service accounts and use Conditional Access for workload identities for service principals instead of user-scoped policies.
     • Avoid applying high-impact controls (block, compliant device only, hybrid joined only, app protection only) to all users / all resources without exclusions.
     • For Power Automate, be cautious when adding Terms of Use requirements; understand that retroactive Terms of Use can break existing Flow connections and cause AADSTS53003.

These steps will allow Microsoft support to unblock the tenant and then let administrators correct the Conditional Access configuration so that Power Automate (Microsoft Flow Portal) and other services can be accessed again.

References:

• Troubleshoot sign-in problems with Conditional Access
• Conditional Access: Authentication flows
• Block authentication flows with Conditional Access policy
• Recommendations for conditional access and multifactor authentication in Microsoft Power Automate (Flow)