Microsoft 365 E5 Instant Sandbox Login failure

Question

Microsoft 365 E5 Instant Sandbox Login failure

Pereira, Raphael 0

I created a new Microsoft 365 E5 Instant Sandbox and receive AADSTS53003 during the very first sign-in. No Conditional Access policies were configured by me because I have never been able to access the tenant. The issue occurs from multiple devices, browsers, and networks. Could you please verify whether the sandbox provisioning or tenant security configuration is preventing the initial Global Administrator sign-in?

Request ID: [Moderator note: Personally Identifiable Information removed] Correlation ID: [Moderator note: Personally Identifiable Information removed] Error Code: 53003

0 comments

1 answer

Your answer

Answer 1

Hi Pereira,

Thank you for providing the additional information.

The error AADSTS53003 means the sign-in was blocked by a Microsoft Entra Conditional Access control before a token could be issued. Microsoft documents this error as BlockedByConditionalAccess. You may refer to Troubleshoot sign-in problems with Conditional Access for more information.

Reference: Troubleshooting sign-in problems with Conditional Access - Microsoft Entra ID

Since this occurs during the first Global Administrator sign-in and you have reproduced it across multiple devices, browsers, and networks, it is reasonable to suspect a tenant-side security configuration or sandbox provisioning issue rather than a problem with a specific device or browser.

Normally, an administrator would check the policy that blocked the sign-in under Microsoft Entra admin center > Entra ID > Monitoring & health > Sign-in logs, using the Correlation ID and the Conditional Access tab. However, because you cannot complete the initial administrator sign-in, Microsoft Community moderators and other forum contributors cannot access the tenant, inspect its Conditional Access configuration, or reset the administrator account. The issue will therefore need to be investigated by Microsoft Support.

You can contact Microsoft through one of the following options:

Call the appropriate Microsoft customer service number for your country or region, as listed on Customer service phone numbers - Microsoft Support.
Sign in to the Microsoft 365 Developer Program dashboard using the Microsoft account or work account originally used to create the sandbox, rather than the affected ******@tenant.onmicrosoft.com account. Open the affected sandbox and use the Support or help option if one is available.
If you administer another Microsoft 365 tenant, you may sign in to that tenant’s Microsoft 365 Admin Center, select Help & support > Contact Support, and open a support request. Clearly explain that the request concerns a separate Microsoft 365 E5 Developer Sandbox whose initial Global Administrator account is blocked. For detailed instructions, see Get support - Microsoft 365 admin.

When contacting Support, please provide the complete Request ID, Correlation ID, error timestamp with time zone, affected sandbox domain, and a screenshot of the error. Also confirm that the failure occurred during the first administrator sign-in and persists across multiple devices and networks.

I hope Microsoft Support can help verify the sandbox provisioning and identify the policy blocking the initial sign-in. If you have any questions, please let me know.

Best regards,