AADSTS530035 security defaults blocks all access for an MSA-backed tenant - what is the MFA registration path?

Question

AADSTS530035 security defaults blocks all access for an MSA-backed tenant - what is the MFA registration path?

KHY 0

My personal Microsoft account signs in successfully, but every Azure and Entra access is denied:

Error code: 530035 (Access has been blocked by security defaults)

App: Azure Portal [Moderator note: Personally Identifiable Information removed]

Tenant: [Moderator note: Personally Identifiable Information removed]

Subscription: [Moderator note: Personally Identifiable Information removed](Azure for Students)

Client: both Azure portal and az CLI

I am the only user and the global admin of this tenant. The account is a personal Microsoft account, so the tenant is MSA-backed.

What I already tried:

Added Microsoft Authenticator to my Microsoft account.
aka.ms/mfasetup - it rejects personal accounts and asks for a work or school account.
Tried the tenant UPN form of my username - that user does not exist.

Because of this I cannot manage my VM, my budgets or the subscription at all, and the portal cannot open a support request either.

Question: for an MSA-backed tenant with security defaults turned on, what is the supported way to satisfy the MFA requirement? Is there a registration endpoint that works for a personal account, or can security defaults be turned off for this tenant some other way?

Thanks.

0 comments

1 answer

Your answer

Answer 1

Dear KHY,

Please understand that this forum is a public platform, and moderators will modify your question to cover your personal information in the description. Please notice to hide these personal or organization information next time you post error or some information to protect personal data.

Based on the information provided, your scenario is somewhat unusual because the administrator identity is a personal Microsoft account (MSA) rather than a standard Microsoft Entra work/school account.

For an MSA-backed tenant, there is no publicly documented MFA registration endpoint equivalent to aka.ms/mfasetup that allows a personal Microsoft account to satisfy the Microsoft Entra Security Defaults MFA registration requirement.

Security Defaults is an Entra ID feature and is designed around Microsoft Entra work or school identities. If your administrator identity is a personal Microsoft account (MSA), adding Microsoft Authenticator or enabling MFA on the Microsoft account itself does not provide a documented method to complete the Entra MFA registration flow.

Similarly, Security Defaults cannot be turned off without administrative access to the tenant. If all administrator access is already blocked by AADSTS530035, there is no known self-service process to disable Security Defaults from outside the tenant.

In short:

There is no documented MFA registration endpoint for an MSA-only administrator to satisfy the Security Defaults registration requirement.
Security Defaults cannot be disabled without first regaining administrative access to the tenant.
If the tenant is fully locked out, Microsoft Support is generally the only available recovery path.
You might need to contact Microsoft Support team via phone service number: Customer service phone numbers - Microsoft Support

You might need to contact Microsoft Support team via phone service number: Customer service phone numbers - Microsoft Support

I hope my information meet your expectations, feel free to reach out if you have any other questions.

Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.