Locked out of Entra ID P2 tenant - Conditional Access blocking all Global Admin accounts

Because every Global Administrator is blocked and the online form rejected the request, contact Microsoft’s business support phone channel and request a complete Entra tenant lockout escalation so Microsoft can validate ownership and temporarily modify the blocking Conditional Access policy.^1^

Open the recovery case without tenant sign-in

1. Open Microsoft’s country/region business-support directory and call the appropriate number.^2^
2. Do not describe this as an ordinary password-reset or personal-account issue. Use wording such as:

   Complete Microsoft Entra tenant lockout caused by Conditional Access. All Global Administrator accounts are blocked, no usable emergency-access administrator exists, and the affected tenant cannot open an authenticated support request. Please create a case against the affected tenant and escalate it for tenant recovery. Microsoft must temporarily modify the blocking Conditional Access policy after validating tenant ownership.

3. Have the following ready:
   • Tenant ID and initial *.onmicrosoft.com domain.
   • Affected administrator sign-in name.
   • Exact error message and error code, if shown.
   • Timestamp, correlation ID, and request ID from the failed sign-in.
   • Subscription or billing details, if applicable.
   • Proof that you control any verified custom domain, if applicable.
   • A working external email address and telephone number.
4. Record the support case number. Request escalation if the initial agent routes the issue to password recovery or says that an authenticated administrator must submit it. Matching lockout cases were recovered after Microsoft support engaged the appropriate Data Protection, tenant-recovery, commercial, or engineering team.^3^

Microsoft may require ownership verification before making a backend change. The team owning the case can vary; Data Protection is a requested escalation path, not a guarantee that it will retain the case.

Check only for an access path that already exists

Before waiting for intervention, use an existing path only if one is already available:

• An emergency-access Global Administrator excluded from the policy.
• An administrator browser session that is still active and can open Entra.
• An active Privileged Role Administrator session that can assign or activate an appropriate role, such as Conditional Access Administrator or Global Administrator.
• An existing CSP partner with active GDAP permissions capable of helping or opening a service request.

Do not create another tenant or account expecting it to administer the locked tenant; it has no authority there. If a CSP partner sold the subscription and has suitable GDAP access, ask it to open the request on your behalf. Microsoft’s tenant-lockout guidance documents that route when the partner has the required Service Support Administrator role.^1^

Password reset and repeated MFA attempts do not remove a Conditional Access policy. They are relevant only if the failure is actually a password or MFA-registration problem rather than a policy block.

After access is restored

Make the smallest possible temporary change. Disabling Conditional Access or excluding an account weakens protection, so record the change, monitor sign-ins, correct the policy promptly, and restore protection immediately.

1. Prefer temporarily excluding one designated emergency-access administrator rather than disabling the whole policy.
2. Put the problematic policy into Report-only mode before editing or retesting it.
3. Correct its assignments, exclusions, authentication-strength requirements, or device requirements.
4. Test with a non-emergency account before turning enforcement back on.
5. Create at least two cloud-only emergency-access accounts:
   • Assign Global Administrator as permanently active.
   • Use strong authentication distinct from normal administrator accounts.
   • Exclude them from Conditional Access policies that block or restrict sign-in.
   • Securely store their credentials and test them at least every 90 days.

Microsoft documents these emergency-access requirements and explicitly recommends two or more such accounts.^4^

References

1. Preventing tenant lockouts
2. Contact Microsoft customer support
3. Locked out of Entra ID P2 tenant - Conditional Access blocking all Global Admin accounts - Microsoft Q&A
4. Manage emergency access accounts in Microsoft Entra ID