Azure subscription disabled for suspicious activity – Unable to access support due to AADSTS5000224

Contact Microsoft customer support outside the inaccessible tenant and request two linked escalations: Microsoft Entra tenant reauthentication for AADSTS5000224 and Azure Subscription/Account Review for the disabled subscription.

Escalate without Azure portal access

1. Open Contact Microsoft customer support and select the business-support option or the customer-service number for your country/region. Explain that Azure portal authentication is impossible because the tenant is deauthenticated. Microsoft publishes this channel for cases requiring direct customer support outside a product portal.^1^
2. Ask the agent to create or route two related cases:
   • Microsoft Entra: Tenant deauthenticated, error AADSTS5000224; request review and re-enablement of tenant authentication.
   • Azure subscription: Subscription disabled for suspected suspicious activity/AUP enforcement; request routing to Azure Subscription/Account Review or the security review team.
   Similar AADSTS5000224 cases required Microsoft engineering to re-enable authentication; this is not a tenant-side portal setting that can be repaired while the tenant remains deauthenticated.^2^
3. Give support:
   • The subscription ID and subscription name privately, not in another public Q&A post.
   • The tenant name or tenant ID, if known.
   • The complete disablement email, including its case/reference number and deletion deadline.
   • The AADSTS error’s timestamp, correlation ID, and trace ID.
   • Proof that the caller is the subscription owner/account billing administrator.
   • A business contact address and phone number that do not depend on the inaccessible tenant.
   • A concise statement that production data must be preserved while the review is pending and will be moved to a commercial subscription if access is restored.
4. Request written confirmation that:
   • The enforcement review has been opened.
   • The deletion deadline is paused or otherwise accounted for while the case is reviewed.
   • Resources and backup data will remain preserved pending the decision.

The documentation supplied does not guarantee that opening a case pauses deletion, so obtain explicit confirmation rather than assuming it does.

If your company has a separate working tenant, Azure subscription, support agreement, or Unified/Premier support entitlement, its administrator can also open the case and reference the affected subscription. Portal support requests require an Owner, Contributor, Support Request Contributor, or equivalent Microsoft.Support/* permission on the affected subscription; account-specific changes can require account billing administrator status.^3^

Data preservation limitations

A disabled subscription does not permit create, update, or action operations (PUT, PATCH, or POST). VMs are deallocated, storage becomes read-only, and temporary IP addresses are released. Although resource retrieval and deletion can remain available, your separate tenant-authentication failure prevents even those authorized retrieval operations.^4^

Consequently, you cannot presently rely on:

• Creating new snapshots or backups.
• Generating disk-export SAS URLs.
• Restoring recovery points.
• Copying resources into another subscription.
• Moving the subscription or changing ownership.

These operations must wait until Microsoft restores the necessary authentication and subscription-management capability. Avoid deleting any VM, disk, snapshot, vault, restore-point collection, or backup item after access returns.

Immediately after access is restored

1. Confirm the subscription is Enabled, not merely that tenant sign-in works. If reactivation completes but resource management still fails after 30 minutes, contact Azure Billing Support through the existing case.^5^
2. Inventory all VMs, managed disks, snapshots, Recovery Services vaults, backup items, public IP dependencies, encryption settings, and customer-managed keys.
3. Restore or export the most important data first:
   • Azure Backup can restore a VM as a new VM or restore its disks.
   • Cross-subscription restore supports eligible VM recovery points across subscriptions in the same tenant, subject to recovery-point tier, vault settings, and RBAC.^6^
   • Managed disks can be exported as VHDs to a storage account using a generated SAS URI.^7^
4. Migrate the workloads to a commercial subscription and validate restored applications before removing anything from the Visual Studio benefit subscription.
5. Review sign-in and activity logs, rotate credentials and secrets, enable MFA, and remove any unauthorized resources before bringing workloads back online.

Also edit the public question to remove the subscription identifier and account address. Provide those only inside the private support case.

References

1. Contact Microsoft customer support
2. Sign-in failed Error code: AADSTS5000224 - Microsoft Q&A
3. Create an Azure support request
4. Azure subscription states
5. Reactivate a disabled Azure subscription
6. How to restore Azure VM data in Azure portal
7. Export/Copy a managed disk to a storage account using the Azure CLI