Whole tenant lockout

Question

Anonymous

Hi,

We have a tenant wide lockout including the breakglass accounts due to a misconfigured policy as part of the ASD blueprint DEV - G - Compliant devices & DEV - B - Block access from unapproved devices.

Can I please get some help so our global admins can login and fix the issue.

Thanks

Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator

2026-05-15T08:44:56.5+00:00

Sam A

Based on the details you’ve shared, this appears to be a tenant lockout scenario.

To resolve this, the recommended approach is to contact the Microsoft Data Protection team. You can reach them by calling Microsoft Customer Service using the phone numbers listed here: https://support.microsoft.com/en-us/topic/customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2

If you have access to another tenant or subscription where you still have Global Administrator privileges, you may also raise a support request from there to get assistance in restoring access to the affected tenant.

For future reference and to help prevent tenant lockouts, please check: https://learn.microsoft.com/en-us/partner-center/customers/gdap-preventing-tenant-lockouts

If neither option is possible, please don’t worry—let us know, we are happy to assist you further!
Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator

2026-05-18T06:12:31.3133333+00:00

Sam A

Following up to check if the resolution provided was helpful. Let us know if you need any further assistance.
Anonymous

2026-05-19T06:22:15.49+00:00

Information provided was helpful. I rang the number and logged a case; issue has been escalated to the Data Protection team. Tenant recovery is under progress.

1 answer

Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator

2026-05-15T08:44:56.5+00:00

Sam A

Based on the details you’ve shared, this appears to be a tenant lockout scenario.

To resolve this, the recommended approach is to contact the Microsoft Data Protection team. You can reach them by calling Microsoft Customer Service using the phone numbers listed here: https://support.microsoft.com/en-us/topic/customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2

If you have access to another tenant or subscription where you still have Global Administrator privileges, you may also raise a support request from there to get assistance in restoring access to the affected tenant.

For future reference and to help prevent tenant lockouts, please check: https://learn.microsoft.com/en-us/partner-center/customers/gdap-preventing-tenant-lockouts

If neither option is possible, please don’t worry—let us know, we are happy to assist you further!
Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator

2026-05-18T06:12:31.3133333+00:00

Sam A

Following up to check if the resolution provided was helpful. Let us know if you need any further assistance.
Anonymous

2026-05-19T06:22:15.49+00:00

Information provided was helpful. I rang the number and logged a case; issue has been escalated to the Data Protection team. Tenant recovery is under progress.

Answer 1

Because all admins and break-glass accounts are locked out by a misconfigured Conditional Access policy, recovery must go through Microsoft support.

Use the following steps:

Verify that no other admin still has access
- If any administrator can still sign in (for example, an account not covered by the policy), that admin can go to Microsoft Entra admin center → Protection → Conditional Access → Policies and disable or edit the blocking policies.
If no admin can sign in (full tenant lockout)
- This matches the documented “locked out because of an incorrect setting in a Conditional Access policy” scenario.
- In this case, an admin must open a support case with Microsoft so support can adjust the Conditional Access policies on the tenant’s behalf.
- Follow the documented guidance to submit a support request as described in the article on troubleshooting Conditional Access lockouts. Microsoft support will review and, after confirming the lockout, update or disable the policies that are preventing access.
After access is restored
- Sign in with a Global Administrator or Conditional Access Administrator account.
- Review and correct the problematic Conditional Access policies.
- Ensure at least two emergency access (break-glass) accounts exist and are excluded from all Conditional Access policies, as recommended in the planning and policy documents.
- Validate new or modified policies in Report-only mode before enabling them to avoid future tenant-wide lockouts.

References: