M365 Developer Program sandbox tenant admin locked out by Conditional Access on first re-login after registration (error 53003)

Glenn Bruggemann 0 Reputation points
2026-11-13T09:44:35.7+00:00

Our M365 Developer Program sandbox tenant was registered today, and on the very first re-login attempt afterward, the admin account is blocked from signing in to any app -- including the "register security info" / MFA setup flow itself -- by what appears to be a pre-existing Conditional Access policy.

Tenant domain: fksrjttyg.onmicrosoft.com

Admin account: [Moderator note: Personally Identifiable Information removed] @fksrjttyg.onmicrosoft.com

Registered today; this is the first sign-in attempt since initial setup

Error: 53003 -- "Your sign-in was successful but does not meet the criteria to access this resource"

App name: Microsoft App Access Panel (appId [Moderator note: Personally Identifiable Information removed] )

Device state: Unregistered, Windows 10

Tried from two different browsers (Chrome, Edge) and two different entry points (mysignins.microsoft.com, admin.cloud.microsoft) -- same result both times, including mid-way through MFA registration.

This is a self-lockout: there's no break-glass account, no other registered/compliant device, and no other user in the tenant. Since this is a Developer Program sandbox (not a paid tenant), Services Hub support says "no access" (requires a Support for Business plan), and the developer.microsoft.com/microsoft-365/support link 404s.

Is there a way for Microsoft to manually clear or adjust the Conditional Access policy on this tenant, or any other path to regain access, short of deleting and losing the sandbox (which then blocks a new one for 60 days)?

Microsoft 365 and Office | Development | Microsoft 365 Developer Program
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Kristen Tran 2,790 Reputation points Independent Advisor
    2026-11-13T10:35:03.2333333+00:00

    Hi Glenn,

    ​Thank you for sharing the detailed context regarding your new Microsoft 365 Developer Program sandbox and the AADSTS53003 (BlockedByConditionalAccess) error.

    ​The AI answer is directionally correct. Because this is a complete Conditional Access lockout on a newly provisioned sandbox where no other Global Administrator or registered device exists, the recovery steps outlined above are accurate. Since self-service bypasses are blocked at the identity layer, even during the initial security info registration flow, engaging the Microsoft Data Protection team is the only supported method to adjust or disable the blocking policy without deleting your sandbox (which would trigger the 60-day replacement cooldown).

    Reference: Troubleshooting sign-in problems with Conditional Access - Microsoft Entra ID

    ​To help move this forward as smoothly as possible, focus on these immediate actions:

    ​Option 1: Contact Microsoft Data Protection Support by Phone (Primary Method) ​

    As you are the sole Global Administrator for the tenant, your Microsoft Authenticator verification is unavailable, the only supported path to regain access is to work directly with Microsoft Support so they can guide you through the account recovery and verification process. ​

    You may try contacting Microsoft Support by phone using the regional contact numbers listed here: Customer service phone numbers - Microsoft Support 

    User's image

    ​Here are some tips and an example of a prompt to help you navigate the IVR more effectively: ​

    When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help. ​In some regions, the initial interaction may be automated, so here’s a general idea of how the conversation might go to help you prepare: ​

    • What kind of problem are you experiencing?
    • Lock out of the only admin ​
    • What products do you use?
    • Office 365 for business ​
    • Is this for an education or company account?
    • For companies ​Are you an administrator?
    • Yes ​
    • Are there any other administrators in your organization?
    • No. I am the only admin in my tenant ​
    • Do you need a... Service request?
    • Yes. I need to create a ticket. Please send me direct to the Data Protection Teams._

    ​During the phone call, you will need to provide the information associated with your subscription, such as your company name, billing details, phone number, and an alternate email address, etc. This information allows the Data Protection team to verify your identity and securely assist you in regaining access to your administrator account. ​

    I also recommend calling during business hours. In my experience, it can be difficult to get through to the correct support queue, and automated systems don't always work as expected. If you can't get through on your first try, I suggest trying again later or at a different time.

    ​Option 2: Create a Temporary Account (Trial Tenant) to Submit a Support Ticket (Alternative Method)

    ​If you're unable to successfully engage support through the phone system, you might consider registering for a new tenant by signing up for a trial subscription (or if you already have another active tenant, you can use that one to create the support ticket).

    ​To set up a new tenant, please follow these steps:

    ​Visit the Microsoft 365 Business Plans and Pricing | Microsoft 365 to create a new tenant following the prompts provided.

    ​Once set up, you can access the admin console of the new tenant and submit a support ticket requesting to speak with the Data Protection team on behalf of your previous tenant.

    ​Follow the guided setup process to create a new account for a new tenant.

    ​Once your tenant is created, you should be able to access the support portal and submit your ticket referencing your locked account without further issues.

    ​Ticket Support: Navigate to the Microsoft 365 Admin Center > Support > Help & Support.

    ​You may refer to the following guide for detailed instructions on how to contact Microsoft Support and open a support case: Get support - Microsoft 365 admin | Microsoft Learn

    Please remember to cancel the trial subscription after your issue is resolved, as this will help you avoid any accidental billing. You may prefer the following resource for detailed instructions: Cancel your Microsoft business subscription in the Microsoft 365 admin center | Microsoft Learn      

    ​I truly hope this helps you regain access to your account quickly. Even though I can't directly intervene, directing you to the correct and specialized support is the most effective help I can provide from my position.

    ​Should you have any further questions, please feel free to let me know.

    ​Warm regards.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-11-13T09:45:40.7833333+00:00

    Try the sign-in once from the same device and network used to create the sandbox; if AADSTS53003 persists, Microsoft Support must review and change the blocking Conditional Access policy because no administrator remains who can do so inside the tenant.^1^

    Recovery path

    1. Use the original provisioning environment
      • Use the device and Internet connection from which the sandbox was registered.
      • Open the sandbox from the Microsoft 365 Developer Program dashboard and attempt security-info registration.
      • Different browsers will not bypass a tenant-side Conditional Access decision, so there is no value in repeating the Chrome/Edge tests.
    2. If it remains blocked, collect the complete error details On the error page, select More details and record:
      • AADSTS53003
      • Request ID
      • Correlation ID
      • Exact date, time, and time zone
      • Application name and application ID
      • Tenant domain and affected administrator UPN
      53003 specifically maps to BlockedByConditionalAccess. Microsoft requests the request ID, date, and time in support incidents so the relevant sign-in event can be located.^2^
    3. Contact Microsoft’s work-account support by phone Use the regional numbers under Work account → Technical or Sales support phone numbers.^3^ Describe the case as:

      New Microsoft 365 Developer Program E5 sandbox. The sole Global Administrator is blocked during first-time security-information registration by AADSTS53003/BlockedByConditionalAccess. No other administrator or emergency-access account exists. Please create a tenant lockout case for Conditional Access recovery.

      If the automated system asks:
      • Product: Office 365 for business
      • Account type: Work/company account
      • Administrator: Yes
      • Other administrators: No
      • Required outcome: Create a service request for tenant lockout
      Do not ask only for a password or MFA reset: the reported failure occurs before access is granted to the registration resource, and the support request needs to be classified as a Conditional Access lockout.

    Microsoft’s documented lockout procedure states that when no administrator can update the policy, a support request is required; after confirmation, Microsoft Support can update the Conditional Access policies preventing access.^2^ A closely matching sole-administrator Developer E5 sandbox case was likewise routed through support for recovery.^4^

    If phone support cannot create the case

    If an eligible paid or trial Microsoft tenant is available, sign in to that tenant’s Microsoft 365 admin center and use Help & support → Create a support request, clearly identifying the separate locked sandbox tenant. A similar Developer Program lockout answer recommends creating a temporary trial tenant when the affected tenant cannot be used to open the request; cancel it before renewal if that route is used.^4^

    The Developer Program address documented on the sandbox setup page is specifically presented for billing/provisioning failures such as delayed provisioning or Customer Agreement errors, not Conditional Access tenant recovery.^5^ Use the tenant-lockout support route rather than relying on that mailbox.

    Do not delete the sandbox while recovery is pending. Developer Program membership permits only one sandbox, and replacement is available only after the current subscription has existed for more than 60 days.^6^

    After access is restored, create an emergency-access administrator and exclude it from relevant Conditional Access policies to prevent another total lockout.^7^

    References

    1. Tenant appears to be a Conditional Access lockout of the sole ...
    2. Troubleshooting sign-in problems with Conditional Access - Microsoft ...
    3. [Work account](https://support.microsoft.com/support/#microsoft-365-volume-licensing-support)
    4. Single Global Administrator locked out of Microsoft 365 Developer E5 Sandbox after losing Microsoft Authenticator - Microsoft Q&A
    5. Set up a Microsoft 365 developer sandbox subscription
    6. Microsoft 365 Developer Program FAQ
    7. Protect security info registration with Conditional Access policy
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.