Lost access to couple of directories

Hello 04569160,

Greetings! Thanks for raising this question in the Q&A forum.

Before anything else, it is worth being clear about what actually happened here. Breaking the Google SAML federation on da8fb2bc-5104-46dd-8262-32edfb64bdd7 locked out every member account whose sign-in is delegated to that Google IdP, since Microsoft Entra ID has nothing to validate the password against once the federation trust is broken or misconfigured. This is not the same as a lost or forgotten password, and there is no way to recover or view the original password itself since Microsoft Entra ID never stores federated passwords at all when a domain is set to federated authentication. The path forward depends entirely on whether the federation config can be fixed, or whether a non-federated account still exists that can sign in directly.

1. Check whether the break happened on the Google side rather than the Entra side Direct federation issues most often come from a certificate rotation, an expired signing certificate, or a changed Entity ID or ACS URL on the identity provider itself, not from anything changing inside Microsoft Entra ID. If you still have access to the Google Workspace admin console for the organization that hosts this SAML app, check the SAML app configuration there first.

Google Admin console > Apps > Web and mobile apps > [your Microsoft Entra SAML app] > SSO configuration

Confirm the SSO URL, Entity ID, and signing certificate in Google still match what is configured in the Entra federation settings. If Google rotated its certificate or you edited the ACS URL, correcting it there can restore sign-in without needing any password recovery at all, since the underlying accounts and their federation trust were never actually deleted.

1. Look for an emergency access break-glass account Well-configured tenants keep at least one cloud-only Global Administrator account that authenticates directly against Microsoft Entra ID with its own password, specifically so federation problems like this one cannot lock out all admins. Check whether such an account exists for the affected directories, since its username would use the default .onmicrosoft.com domain rather than your custom verified domain, and it bypasses SAML federation entirely.

https://portal.azure.com (sign in with an account like ******@da8fb2bc....onmicrosoft.com or the tenant's default onmicrosoft.com domain)

If you genuinely never created one, or do not know its credentials, this route is not available, and you should move to the next step.

1. If no working admin account exists anywhere, this becomes a formal tenant recovery case Microsoft cannot simply hand over or reset credentials for a directory based on a forum post, since doing so with only a directory ID as proof would be a serious security risk if the requester is not actually the tenant owner. Microsoft has a defined process for organizations that have lost every Global Administrator, but it requires verifying you own or represent the organization, typically through DNS TXT record proof for the verified domain, business registration documents, or billing history tied to the tenant.

https://portal.azure.com > Help + support > New support request (from any account, even one without admin rights, if one exists)

If truly no account across any of the affected directories can sign in at all, you will need to contact Microsoft Support directly by phone, since a portal-based ticket generally requires at least one authenticated session.

1. Do this for each directory separately Since CS-OPS-6745, OPS-7011-Uptycs-Stack, OPS-7921-CIS, and OPS-7921-CIS-Certification are separate tenants (not sub-resources of the main directory), each one needs its own recovery case if none of them share a working break-glass account, even though the root cause across all of them traces back to the same broken Google federation trust.

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix