Microsoft 365 features that help users manage their subscriptions, account settings, and billing information.
Before proceeding with tenant recovery, I would first determine why the administrator accounts are unable to sign in.
If the lockout is caused by a Conditional Access policy, check whether another administrative account still has sufficient permissions to manage Conditional Access, for example an account assigned the Conditional Access Administrator role. If such an account can still sign in, it may be possible to correct the problematic policy without going through a full tenant recovery process.
Also check whether another Global Administrator, delegated partner administrator, or existing emergency-access account still has working administrative access.
If no account with sufficient administrative privileges can sign in, then this should be treated as a full tenant lockout. Microsoft responses to similar cases direct customers to Microsoft Support and the Data Protection Team for tenant/admin recovery
- Contact Microsoft Support and explicitly state that this is a tenant lockout / Global Administrator recovery case and request escalation to the Data Protection Team. Similar complete lockout cases are handled through this route. https://support.microsoft.com/en-us/support/
- Make it clear in the existing support cases that no Global Administrator can sign in and that you require administrator account recovery. Be prepared to provide the information Microsoft requests to verify ownership of the tenant. Microsoft's guidance confirms that proof of tenant ownership may be required before access is restored.
- Yes. Microsoft's responses to similar tenant-lockout cases refer to the Data Protection Team for identity/ownership verification and restoration of secure administrative access.
- Contact Microsoft Support outside the affected tenant, for example through Microsoft's business support phone channel. Microsoft moderators have also suggested opening a support case from another/trial tenant when it is impossible to create a case from the locked tenant, clearly stating that the request concerns another inaccessible tenant.
- Reference the existing case numbers and explicitly request escalation as a business-critical tenant lockout requiring Data Protection/Tenant Recovery assistance. Avoid treating this simply as a normal password or MFA-reset issue, since there is no accessible administrator available to perform the recovery internally.
- Community moderators cannot directly modify accounts or restore tenant access. The cases need to be handled through Microsoft Support and the appropriate recovery team. A Microsoft moderator may be able to help direct the case appropriately, but the actual recovery must follow Microsoft's secure support process.
Once access has been restored, I strongly recommend implementing dedicated Emergency Access ("break-glass") Global Administrator accounts.
These should be separate from normal administrator accounts, carefully monitored, and designed so that the same authentication or Conditional Access failure cannot lock out both the normal administrators and the emergency accounts. In particular, the organization should review its Conditional Access design and make the appropriate exclusions for the emergency-access accounts.
That can turn a future incident from a complete tenant lockout requiring Microsoft-assisted recovery into something the organization can recover from itself.