Need a quick assistance for a tenant lockout

If the business administrator who opened the case—or another authorized administrator—can still access Microsoft Entra, have that administrator immediately disable the blocking Conditional Access policy or exclude a recovery administrator; Microsoft Support recovery is required only when no administrative access path remains.

Attempt recovery through an available administrator

Check whether any of these paths still works:

• Another Global Administrator or Conditional Access Administrator
• An excluded emergency-access account
• An existing privileged browser session that remains active
• A Privileged Role Administrator able to activate sufficient access
• A Microsoft partner with an active GDAP relationship and suitable role

If one is available:

1. Open the Microsoft Entra admin center.
2. Go to Protection → Conditional Access → Policies.
3. Open the policy responsible for the lockout.
4. Either:
   • Set Enable policy to Off, or
   • Exclude a designated recovery administrator under Assignments → Users.
5. Save the policy, sign in with the recovered administrator, and correct the policy safely before re-enabling it.

An administrator who retains access can disable the policy affecting sign-in; when no administrator can update it, Microsoft Support must intervene after verification ^1^.

Escalate the existing support request

Since a case is already open, continue with that case rather than starting a duplicate:

1. In the Azure portal, open Help + support → All support requests.
2. Select the existing request.
3. Select New message and add:
   • “Microsoft Entra tenant lockout caused by Conditional Access”
   • Tenant ID and verified domain name
   • Whether all Global Administrators are blocked
   • Whether emergency accounts, active sessions, PIM activation, and GDAP access are unavailable
   • Business impact and affected production services
   • Lockout start time in UTC
   • Exact sign-in error, timestamp, and correlation/request ID
   • A continuously monitored phone number and email address
   • Requested outcome: restore a designated Global Administrator’s access so the Conditional Access configuration can be corrected
4. Select Change severity and choose the highest level that accurately reflects the business impact and is available under the support plan. If an engineer is already assigned, send a message requesting the change instead. Customer service can also change severity when urgent and the assigned engineer is unavailable ^2^.

Managing an Azure subscription-linked request requires Owner, Contributor, or Support Request Contributor at subscription scope. A request created without a subscription requires an applicable administrator role ^2^.

Do not place passwords, access tokens, private keys, or customer data in the ticket. Include the impact and requested tenant-lockout assistance without delaying escalation to gather every possible diagnostic ^3^.

If the case cannot be accessed or updated

Call the Microsoft customer-service number for the appropriate country or region and ask the agent to locate and escalate the existing case as a “complete Microsoft Entra tenant lockout.” Microsoft documents phone support as the recovery route when tenant lockout prevents portal access ^4^ ^5^.

Be prepared for a high-assurance tenant-ownership verification process. After ownership is validated, Microsoft can help designated Global Administrators regain access to the existing tenant; it does not create a replacement tenant ^4^.

Normally, keep one case active. If the authorized business administrator cannot manage the original request, Microsoft’s documented fallback is to create another support request specifically explaining the problem managing the original and referencing its case number ^2^.

Public Q&A participants generally cannot inspect or modify private support cases, so the existing support case or customer-service channel remains the operative escalation route.

After access is restored

Create at least two cloud-only emergency-access accounts, assign permanent active Global Administrator roles, use independent phishing-resistant authentication, exclude them from Conditional Access policies that block or restrict sign-in, monitor their use, and test them regularly ^6^.

References

1. locked out of my tenant due to conditional access - Microsoft Q&A
2. Manage an Azure support request
3. Step 2: Contain: Stop the attack
4. Plan for tenant recoverability
5. Contact Microsoft customer support
6. Manage emergency access accounts in Microsoft Entra ID