Azure Portal access denied — AADSTS530035 after Pay-as-you-go upgrade

Because personal-account two-step verification is already enabled and AADSTS530035 blocks the Azure portal, Entra admin center, and support blade, submit a portal-independent Azure support request and ask for tenant access recovery/Data Protection escalation, without disabling Security Defaults or creating another subscription.

Open the support request without Azure Portal access

Use Microsoft’s Azure sign-in troubleshooting support form:

Create an Azure support request without portal access

Microsoft specifically provides this route for customers who cannot sign in to the Azure portal.^1^

If that form cannot be completed, use Microsoft customer support, select Personal account, then Get help, and request routing to Azure subscription/account support.^2^

Provide this description:

AADSTS530035 blocks access to my Azure tenant after my Azure Free subscription was upgraded to Pay-as-you-go. The affected identity is a personal Microsoft account. Two-step verification is already enabled, but Azure Portal, Microsoft Entra admin center, and the Azure support blade are all blocked. Please verify the tenant associated with my existing subscription and escalate for tenant access recovery/Data Protection review if an administrator-side MFA reset is required. Do not create a new subscription or disable Security Defaults. Please also confirm the subscription state and whether the existing Azure AI Speech resource remains provisioned.

Include the following privately in the support case, not in Microsoft Q&A:

• The Correlation ID, Request ID, timestamp, and full AADSTS530035 message from the error page.
• The personal Microsoft account address.
• Subscription or billing identifiers from the Pay-as-you-go confirmation email.
• The upgrade date and payment confirmation.
• The Speech resource name and resource group, if known.
• Whether this account is the tenant’s only Global Administrator.

If it is the only Global Administrator, state that explicitly. Comparable sole-administrator tenant lockouts have required the Data Protection team to restore access.^3^

What AADSTS530035 establishes

AADSTS530035 indicates that the sign-in was blocked by Microsoft Entra Security Defaults. Security Defaults protects privileged management surfaces—including Azure Portal, Microsoft Entra admin center, Azure PowerShell, and Azure CLI—and requires MFA for access.^4^

Azure authentication occurs in an Entra tenant context even when the subscription was created with a personal Microsoft account. Enabling consumer-account two-step verification was the documented first action for a personal account used to subscribe to Azure.^5^ Since that action is complete and all administrative entry points remain blocked, an administrator-side reset or Microsoft-assisted tenant recovery is the appropriate next step.

Do not disable Security Defaults. It is not necessary for the requested recovery, and access is currently unavailable to change it anyway.

If another Global Administrator exists

Only if another administrator can still enter the tenant, that administrator can perform the recovery:

1. Open Microsoft Entra admin center.
2. Go to Identity → Users → All users.
3. Select the affected personal-account user.
4. Open Authentication methods.
5. Select Require re-register MFA.
6. Sign in again with the affected account and register the prompted method.

This procedure resolved a closely matching personal-account Azure lockout where the personal identity existed as a guest in the tenant.^6^ If no other administrator exists, this branch is unavailable and support must perform the recovery.

Subscription and Azure AI Speech resource

The successful Pay-as-you-go upgrade and the sign-in block are separate issues. When a free subscription was disabled because its credit expired, upgrading enables non-free resources again; Microsoft notes that usage can then generate charges.^7^

Most Azure resources resume automatically after subscription reactivation, although Microsoft recommends checking each resource and restarting it if necessary.^8^ Therefore, AADSTS530035 alone does not show whether the Speech resource exists or is running.

Ask support to confirm:

1. The subscription is Active, not Disabled or Past Due.
2. The original subscription ID was upgraded rather than replaced.
3. The Speech resource still exists under that subscription.
4. Its current provisioning and billing state.

After access is restored, select the correct tenant, open Subscriptions, confirm the Pay-as-you-go subscription is Active, and then locate the Speech resource under All resources.

References

1. Troubleshoot Azure subscription sign-in issues
2. Contact Microsoft customer support | Microsoft Support
3. Unable to log into personal Azure account, but continue to be billed for services - Microsoft Q&A
4. Security defaults in Microsoft Entra ID
5. Verify mandatory MFA setup for Microsoft Entra users - Microsoft Entra ...
6. Cannot access Azure Portal under personal account - Microsoft Q&A
7. Upgrade your Azure free account or Azure for Students Starter account
8. Reactivate a disabled Azure subscription