Admins are all locked out of our accounts due to conditional access policy and created trial tenant

To recover from a Conditional Access lockout where all admins are blocked and only a trial tenant is available, the supported path is:

1. Confirm no other admin can still sign in
   Ensure there truly is no Global/Conditional Access admin or emergency access (break-glass) account that can still access the original tenant. If any such account exists, that admin should sign in to the Microsoft Entra admin center for the affected tenant and disable or modify the misconfigured Conditional Access policies.
2. Use emergency access accounts going forward
   Microsoft recommends always excluding emergency access (break-glass) accounts from Conditional Access policies to prevent tenant-wide lockout. These accounts should be excluded in the Users or workload identities → Exclude section of each policy and used only for recovery.
3. If all admins are locked out, open a Microsoft support request
   When no admin can sign in to the affected tenant, Microsoft support must intervene:
   • If any admin can still sign in to any tenant (including a trial tenant), they should open a support request from that tenant and clearly state that the issue is a tenant lockout due to Conditional Access on another tenant, and that no admin can sign in to the locked tenant.
   • For Conditional Access lockouts, Microsoft support (Data Protection / Tenant Recovery team) can review and, after verifying ownership, update or disable the Conditional Access policies that are preventing access.
4. If support has already been engaged but you are stuck
   Since there is already a ticket and a Microsoft engineer has remoted in, the next step is to ensure the case is explicitly routed to the Data Protection / Tenant Recovery team and that the problem is clearly described as:
   • All admins locked out of the primary tenant due to Conditional Access.
   • No emergency access account available or able to sign in.
   • Need Microsoft to temporarily relax or disable the blocking Conditional Access policies on the locked tenant.
5. Future prevention
   After access is restored:
   • Create at least two emergency access (break-glass) accounts and exclude them from all Conditional Access policies.
   • Test new Conditional Access policies in Report-only mode first and verify impact before enabling On.
   • For high-risk policies (such as broad block policies), follow Microsoft guidance to avoid tenant-wide lockout.

These are the only supported ways to recover when Conditional Access has locked out all admins; Q&A itself cannot change tenant settings or policies.

References:

• Troubleshoot sign-in problems with Conditional Access
• Require multifactor authentication for admins accessing Microsoft admin portals
• Apply Conditional Access policies to Global Secure Access internet traffic
• Apply Conditional Access policies to Private Access apps
• Configure Conditional Access policies for Dev Box
• Conditional Access policy templates
• Require multifactor authentication for all users
• Protect security info registration with Conditional Access policy
• Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• Global Admin Locked out - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• Locked out of my Outlook account and recovery options not working - Microsoft Q&A
• I need to speak with a real person and it seems impossible. - Microsoft Q&A