URGENT: Microsoft Entra ID Tenant Lockout – Conditional Access – Global Administrator Recovery

Because no accessible administrator or excluded emergency account remains, Microsoft Support must open a tenant-lockout recovery case and verify ownership before the Conditional Access policy can be changed. A matching Conditional Access lockout case was restored through a support ticket handled by Microsoft’s Data Protection team.^1^

Open the recovery case without the locked tenant

1. Remove the Tenant ID and administrator sign-in address from this public post. Provide them only through Microsoft’s private support channel.
2. From an account and browser session not tied to the locked tenant, use Microsoft’s published customer-support page and select the number for your country or region.^2^
3. Tell the representative:

   All Global Administrators are locked out by a Microsoft Entra Conditional Access policy. No emergency-access account is available, and the affected tenant cannot open a support request. Please create a tenant-lockout case for the affected tenant and route it for tenant ownership verification and access recovery.

4. Have the following available privately:
   • Tenant ID and initial *.onmicrosoft.com domain
   • Locked Global Administrator username
   • Reachable email address and phone number
   • Azure or Microsoft 365 subscription and billing information, if applicable
   • Proof that you control any verified custom domain, if applicable
   • Approximate time the policy was created and the displayed sign-in error
   • Any existing support or subscription identifiers
5. Obtain and retain the support case number. Do not post verification documents, credentials, MFA codes, or tenant identifiers in Q&A.

Microsoft Q&A cannot modify the tenant directly. Comparable sole-administrator lockouts are resolved by opening a Microsoft Support case and routing it to the team that performs ownership verification and tenant recovery.^3^

If telephone support cannot create the case

Create a temporary Microsoft 365 trial tenant with a different account, sign in to its Microsoft 365 admin center, and use Help & Support → Contact support to request assistance for the locked tenant. This workaround is documented in a matching sole-administrator lockout answer; remove the temporary tenant or prevent renewal after the case is submitted.^3^

If the affected subscription was purchased through a Cloud Solution Provider or reseller, ask that provider to open the support ticket on your behalf. This is the practical escalation path in a matching Conditional Access case when Microsoft’s direct support channel could not create the case.^4^

Do not keep retrying the blocked sign-in or attempt to work around Conditional Access through unrelated password-reset flows. Changing the password does not provide authority to edit the policy, and repeated sign-in attempts can cause additional temporary protection blocks.^5^

Immediately after access is restored

1. Change the problematic policy to Report-only or disable it while correcting its assignments.
2. Review the Entra sign-in and audit logs for the lockout period.
3. Create at least two cloud-only emergency-access accounts using the *.onmicrosoft.com domain.
4. Assign each account a permanent active Global Administrator role—not a PIM-eligible assignment.
5. Configure phishing-resistant authentication, such as FIDO2/passkeys, separately from normal administrator authentication.
6. Exclude the emergency-access group from every Conditional Access policy that blocks or restricts sign-in.
7. Store credentials securely, monitor every use, and test the accounts at least every 90 days.

Microsoft’s emergency-access guidance documents these safeguards specifically to prevent administrative lockout and recommends at least two independent accounts.^6^

References

1. All Global Administrator accounts are locked out due to Conditional Access. - Microsoft Q&A
2. Contact Microsoft customer support
3. Global Administrator Locked Out | MFA Reset request. On behalf of a Microsoft Business 365 Account - Microsoft Q&A
4. Microsoft 365 tenant locked out due to conditional access requirement - Microsoft Q&A
5. Common problems with two-step verification for a work or school account
6. Manage emergency access accounts in Microsoft Entra ID