New tenant denies access to its only Global Administrator with AADSTS5000228

Question

New tenant denies access to its only Global Administrator with AADSTS5000228

Mateus Lara 0

We created a Microsoft Entra ID tenant yesterday, in order to publish an Office add-in. Since then, the only Global Administrator cannot get in anywhere. The password is accepted, but authorization fails.

The Entra admin center returns AADSTS5000228, saying access to the tenant is denied and to contact the administrator. The Microsoft 365 admin center returns a bare HTTP 401. Partner Center shows "Access restricted" on every page, so the enrollment cannot even begin.

It does not look like a Conditional Access block: the documented message for that case names the policy, and this one does not. It does not look like a missing role either, since a role problem shows an explanatory page rather than a 401. And the tenant is one day old, so inactivity is not it.

The difficulty is that every support path requires signing in to the very tenant that is denying access, and the phone numbers listed for my country did not lead to a case being opened.

Is there a supported way to get an access recovery case opened for a tenant in this state? I can provide the tenant id, the trace and correlation ids, and company registration documents privately to whoever can route this.

0 comments

1 answer

Your answer

Answer 1

Create a temporary Microsoft 365 trial tenant, open a support request from that tenant, and ask Microsoft Support to register the case against the inaccessible tenant and transfer it to Data Protection/Tenant Recovery.

Open the recovery case

This workaround is documented in an accepted Microsoft Q&A answer for the same combination of circumstances: a new tenant, AADSTS5000228, one inaccessible Global Administrator, and no ability to create a case from the affected tenant.^1^

Create a Microsoft 365 business trial using a different tenant and an account you can access.
Sign in to the Microsoft 365 admin center for that temporary tenant.
Select Support → Help & support and create a service request.
State clearly that:
- The request concerns another, inaccessible tenant.
- The only Global Administrator is locked out.
- Authentication accepts the password, but authorization fails with AADSTS5000228.
- Entra and Microsoft 365 administration are inaccessible, so no case can be opened there.
- You need the case created for the affected tenant and escalated to Data Protection/Tenant Recovery.
Keep the temporary tenant active until recovery is complete, then cancel the trial to prevent charges.

Suggested case text:

The affected Microsoft Entra tenant is completely locked out. Its only Global Administrator receives AADSTS5000228 after successful password authentication, and no administrative portal can be accessed.

This support request is being submitted from a temporary tenant because the affected tenant cannot open support requests. Please create or associate the case with the affected tenant and escalate it to the Data Protection/Tenant Recovery team for high-assurance tenant ownership verification and administrator-access recovery.

Tenant ID: [tenant ID]
Primary tenant domain: [tenant.onmicrosoft.com]
Error timestamp (UTC): [timestamp]
Correlation ID: [correlation ID]
Trace/Request ID: [ID]

Microsoft’s official recovery guidance confirms that, during tenant lockout, Support performs high-assurance ownership verification and then helps the designated Global Administrator regain access to the existing tenant; Microsoft does not replace it with a new tenant.^2^

Prepare for ownership verification

Have the following ready, but provide it only through the private support case, not in Microsoft Q&A or another public forum:

Tenant ID and initial onmicrosoft.com domain
Affected Global Administrator sign-in name
UTC timestamp, correlation ID, trace/request ID, and complete error text
Organization registration documents
Proof that the requester is authorized to represent the organization
Custom-domain ownership evidence, if a custom domain was added
Subscription, order, invoice, or billing information, if any exists
Contact details that work independently of the locked tenant

Because the tenant is only one day old, tell Support explicitly if no invoice, subscription history, or custom domain exists. Support determines which alternative evidence is acceptable during its verification process.

Other supported escalation route

If a Microsoft partner already has an active GDAP relationship with the affected tenant and the Service Support Administrator role, that partner can create the service request on your behalf. For Data Protection cases, Microsoft must still work directly with the affected customer, so the partner should include the impacted administrator’s external phone and email contact details.^3^

This option does not apply merely because Partner Center is available: the required GDAP relationship and role must already exist. Since enrollment has not begun, the temporary-tenant support request is the practical next route.

Do not publish the tenant ID, administrator address, company documents, or complete diagnostic records in this thread. Q&A moderators cannot unlock tenants or perform ownership verification.

References