AADSTS500571: personal Microsoft account locked out of Azure portal (account locked)

AADSTS500571 means the guest user object is disabled in the resource tenant; if no other administrator can access that tenant, contact Microsoft Support by phone and request recovery of the existing Microsoft Entra tenant. ^1^

What the error establishes

• The affected object is the guest user object in the tenant handling the Azure Portal sign-in.
• Your personal Microsoft account is a separate identity. Its successful use on Microsoft Account and Microsoft Learn is therefore consistent with the Azure tenant-side object being disabled.
• The error does not establish that you created or own the tenant, or that the affected object has Global Administrator rights.
• This is not the temporary sign-in lockout represented by AADSTS50053, nor the general disabled-user code AADSTS50057. ^2^

Reconfiguring consumer-account MFA or clearing browser data cannot enable a disabled Entra object, so those completed steps do not need to be repeated.

If you are the only administrator

There is no self-service operation that a disabled object can use to enable itself. Microsoft’s tenant-recovery guidance says to open a Microsoft Support case; when the portals are inaccessible, call customer service. Microsoft verifies tenant ownership and, after successful verification, helps designated Global Administrators regain access to the existing tenant. ^3^

1. Open Microsoft’s regional customer-support directory and select the appropriate number. ^4^
2. Ask for a case to be opened for: “Microsoft Entra tenant lockout — AADSTS500571 — possible sole administrator; Azure and Entra portals inaccessible.”
3. Provide privately to the support engineer:
   • The affected tenant ID.
   • The personal Microsoft account used for the Azure signup.
   • The complete error text, timestamp, request ID, and correlation ID.
   • Any Azure subscription IDs, billing records, invoices, original signup messages, or domain-ownership evidence associated with the tenant.
   • Confirmation that the personal Microsoft account remains accessible but the tenant-specific Azure sign-in fails.
4. Request that the case be routed to the team responsible for tenant ownership verification and administrator-access recovery.

Do not post subscription, billing, request, correlation, or tenant identifiers publicly. Preserve the values already captured for the private support case.

If Microsoft identifies another tenant owner or sponsor

That administrator must determine whether the guest account should remain disabled. If it was disabled by mistake, the resource-tenant owner can re-enable its AccountEnabled property. Microsoft documents this as the normal resolution for AADSTS500571. ^1^

If the tenant belongs to another organization, only its owner or sponsor—not consumer Microsoft-account support—can authorize that change. If it is your own Azure-created tenant and no other administrator exists, continue through the Microsoft-assisted tenant-recovery process above.

References

1. Error AADSTS500571 - Guest user account is disabled
2. Microsoft Entra authentication and authorization error codes
3. Plan for tenant recoverability
4. Contact Microsoft customer support