Urgent: Sole Global Admin locked out of Microsoft 365 Developer Legacy Sandbox tenant

A sole-Global-Administrator lockout must be handled through a Microsoft Support tenant-recovery case, where Microsoft performs identity verification and restores access to the existing tenant.^1^

Request tenant recovery

A Private Message cannot be opened from this response. Do not post the Tenant ID, administrator UPN, registration email, card details, or identity documents publicly.

Since telephone support has not been reachable:

1. Open Contact Microsoft customer support while signed in with a separate, working Microsoft account, if available.^2^
2. Select Get Help, describe the issue, and then select Contact Support when offered.
3. Use wording such as:

   Microsoft 365 business tenant lockout — the only Global Administrator is directory-locked. No other administrator can open a service request. Request tenant recovery and escalation for high-assurance tenant-ownership verification.

4. Include these non-secret facts initially:
   • It is a Microsoft 365 Developer Program Legacy Sandbox.
   • The only Global Administrator receives “Your account has been locked.”
   • No other Global Administrator exists.
   • The tenant’s initial domain, without disclosing passwords or verification codes.
5. Provide the Tenant ID, Developer Program registration details, and ownership evidence only after Microsoft supplies a private support channel or secure upload mechanism.

Microsoft documents that, after ownership verification, Support helps a designated Global Administrator regain access to the existing tenant; it does not issue a replacement tenant.^1^ Matching sole-admin lockout cases on Microsoft Q&A were escalated through support tickets to the Data Protection team for contact by email or telephone.^3^

The failed trial signup and regional card validation are separate from recovery of this existing directory. Creating another trial would not restore administration of the locked tenant.

Check the tenant’s retirement deadline

Sign in to the Microsoft 365 Developer Program dashboard with the Developer Program membership account, if that account remains accessible, and record the legacy sandbox’s displayed expiration date.

Legacy sandboxes cannot be renewed again, converted, or transferred. After expiration, a legacy subscription remains read-only for 30 days and is then permanently deleted; deletion cannot be reversed by Microsoft.^4^

Therefore, tell Support the displayed expiration or deletion date and request urgent handling if the tenant is already in its recovery window. Regaining administrator access does not cancel the legacy-sandbox retirement schedule. Once access is restored, immediately export required app registrations, code/configuration references, Power Platform solutions, content, mail, users, groups, and settings.

If the actual error is inactivity blocking

Only use this branch if the sign-in error specifically contains:

AADSTS5000225: This tenant has been blocked due to inactivity

That condition has a different deadline: an administrator can request reactivation within 20 days of the tenant entering the inactive state; after that period the tenant is deleted. Microsoft also advises against opening duplicate requests while a case is pending.^5^

The generic “Your account has been locked” message alone does not establish that the entire tenant was blocked for inactivity.

References

1. Plan for tenant recoverability
2. Contact Microsoft customer support | Microsoft Support
3. Locked out of Microsoft 365 Admin portal - Microsoft Q&A
4. Retirement of Microsoft 365 Legacy developer subscriptions
5. Tenant inaccessible due to inactivity