AADSTS53003: Conditional Access blocks MFA registration on new E5 developer sandbox — sole Global Admin locked out

Henrik Andersen 0 Reputation points
2026-09-01T17:41:40.7+00:00

I set up a Microsoft 365 E5 developer sandbox tenant and am trying to sign in as the tenant's only Global Administrator for the first time, via https://admin.microsoft.com and https://portal.azure.com.

Sign-in with username and password succeeds. The tenant then requires MFA registration, but when I click Next the registration flow is blocked with:

Error Code: 53003 — Access has been blocked by Conditional Access policies

Application: Microsoft App Access Panel

App ID: 0000000c-0000-0000-c000-000000000000

Request Id: cbf63469-e91a-406c-bdb5-7815911eff00

Correlation Id: 4dcabf02-9068-45f3-8f74-62a5da3f7bcd

Timestamp: 2026-08-31T19:07:43Z

Device platform: Windows 10

Device state: Unregistered

This creates a deadlock: I cannot register MFA because the registration app itself is blocked by Conditional Access, and I cannot sign in to view or change the Conditional Access policies because sign-in requires MFA. I am the only Global Administrator in the tenant, and no MFA method has ever been registered on the account.

My assumption is that the Microsoft-managed Conditional Access policies auto-enabled on this tenant after the report-only period expired, and that they now also apply to the Microsoft App Access Panel used for combined security-info registration.

What I have already tried, all with the same 53003 result:

Questions:

  1. Is there any supported way to complete security-info registration when the Microsoft App Access Panel is blocked by Conditional Access?
  2. If not, what is the correct path to have the Microsoft-managed Conditional Access policies set to Off/Report-only on this tenant, or to have a Temporary Access Pass issued for the admin account?

I can provide the tenant ID and admin UPN privately if needed. I contacted the developer program support alias and have had no response.

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Abdul Waqas 345 Reputation points
    2026-09-05T17:56:09.0133333+00:00

    Hi,

    This looks like a Conditional Access lockout. If the Microsoft-managed policy has moved from Report-only to On, it can block the MFA registration process itself. Without a second admin or break-glass account, this can create a complete sign-in deadlock.

    A few things to check:

    1. Confirm whether Security Defaults is enabled in addition to Conditional Access.
    2. A Temporary Access Pass (TAP) could normally help with first-time MFA registration, but issuing one requires admin access, so it may not be an option in this case.
    3. Since there is no other admin and the CA policy is blocking sign-in, this will likely require Microsoft Support to recover the tenant. When contacting them, mention that the sole administrator is locked out by Conditional Access during MFA registration and provide error AADSTS53003.
    4. Avoid repeatedly trying different sign-in methods, as they will still be evaluated against the same CA policy.

    For future tenants, create a break-glass/emergency access account immediately and exclude it from Conditional Access policies before enabling them.

    This appears to be a tenant-level lockout rather than something that can be resolved through normal portal settings.

    Was this answer helpful?

    1 person found this answer helpful.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.