Microsoft Entra ID Global Administrator lockout after Conditional Access MFA policy change

Rahul Mehta 0 Reputation points
2026-10-22T07:43:12.6266667+00:00

Microsoft Entra ID — Global Administrator Lockout

Issue category: Microsoft Entra ID / Authentication / Conditional Access / MFA

Issue severity: High — Administrative access unavailable

Environment: Microsoft Azure Pay-As-You-Go subscription with Microsoft Entra ID P2 licensing

1. Problem Summary

I am requesting Microsoft technical assistance to recover administrative access to my existing Microsoft Entra ID tenant.

During a controlled Microsoft Entra ID security lab, I configured and enabled a Conditional Access policy to test multifactor authentication (MFA) enforcement.

Following this configuration change, my Global Administrator accounts became unable to sign in to Microsoft Azure Portal and Microsoft Entra Admin Center.

Both available Global Administrator accounts are affected.

A separate standard user account can still successfully access Azure Portal, confirming that the tenant remains accessible to at least one user. However, this account cannot access Conditional Access policy management because it lacks the required administrative privileges.

I need assistance recovering administrative access without deleting or rebuilding my existing tenant.

2. Environment Details

Cloud platform: Microsoft Azure

Identity platform: Microsoft Entra ID

License: Microsoft Entra ID P2

Azure subscription: Pay-As-You-Go

Tenant: Existing Microsoft Entra tenant

Affected accounts: Two Global Administrator accounts

Working account: One non-administrator user

Affected portals: Microsoft Azure Portal and Microsoft Entra Admin Center

Tenant ID and affected account identifiers can be supplied securely to the Microsoft support engineer.

3. Configuration Change Before the Incident

I was performing a Conditional Access MFA enforcement test.

Policy name: CA-L14-Require-MFA-Pilot

The policy was configured with:

Users: A dedicated MFA pilot security group

Excluded users: One user exclusion was configured

Target resources: All resources

Grant control: Require multifactor authentication

Client application condition: Browser

Initial policy state: Report-only

Subsequent policy state: On

The policy was initially tested using the Conditional Access What If tool in Report-only mode.

After enabling the policy, administrator sign-in failures were observed.

I attempted to change the policy back to Report-only, but I cannot confirm that the rollback was successfully saved before administrative access was lost.

The precise cause of the failures has not yet been verified through sign-in logs.

4. Symptoms and Errors

The following symptoms were observed:

Global Administrator accounts could not complete Microsoft sign-in.

Microsoft displayed: "We couldn't sign you in. Please try again."

One administrator sign-in also displayed: "More information required," requesting multifactor authentication before proceeding.

Both Azure Portal and Microsoft Entra Admin Center became inaccessible to the affected administrator accounts.

A standard user account could still sign in to Azure Portal.

When the standard user attempted to open Conditional Access policies, Azure displayed HTTP 401 with the message: "Insufficient privileges to complete the operation."

I have not yet obtained a verified AADSTS error code from the failed administrator sign-in logs.

5. Troubleshooting Already Performed

Attempted sign-in using both Global Administrator accounts.

Attempted sign-in using an Incognito/InPrivate browser window.

Confirmed that a standard user account could still access Azure Portal.

Attempted to open Conditional Access management using the standard user.

Confirmed that the standard user lacks permission to manage Conditional Access.

Inspected the Security Defaults configuration screen without applying further changes.

Opened Azure Help + Support and its automated diagnostic interface.

Attempted to create an Azure support request.

Found that the available support form offered billing and subscription-management categories rather than a suitable Entra technical support category.

An automated troubleshooting response suggested a possible Conditional Access misconfiguration, but this has not been independently confirmed.

6. Business and Administrative Impact

Both available Global Administrator accounts are unable to access the tenant.

Consequently, I cannot reliably:

Review or modify Conditional Access policies.

Confirm or reverse the recent MFA policy change.

Manage tenant-wide security configurations.

Restore administrator authentication methods through the affected administrator accounts.

Continue existing Microsoft Entra configuration and validation activities.

A standard user remains able to access Azure Portal but does not have the permissions needed for administrator recovery.

7. Assistance Requested From Microsoft

Please assist with the following:

Verify ownership of the existing Microsoft Entra tenant.

Investigate the failed Global Administrator sign-ins, including the relevant authentication and Conditional Access evaluation results.

Determine whether CA-L14-Require-MFA-Pilot, Security Defaults, authentication-method registration requirements, or another configuration is responsible.

If a Conditional Access policy is confirmed to be blocking all administrators, assist with a supported recovery or rollback procedure.

Restore access to at least one authorized Global Administrator account.

Preserve existing tenant configurations, user accounts, groups, administrative role assignments, applications, and licensing.

Provide guidance on validating emergency access accounts and preventing future administrative lockouts.

Please do not delete, reset, or recreate the tenant as a routine recovery step.

8. Supporting Evidence Available

I can provide screenshots showing:

The Conditional Access policy configuration and Report-only testing.

The policy's On state.

Administrator sign-in failures.

The MFA registration prompt.

Successful Azure Portal access by a standard user.

HTTP 401 when accessing Conditional Access policies.

The Azure automated troubleshooting response.

The Azure support request category limitations.

9. Requested Outcome

My requested outcome is to regain secure Global Administrator access to the existing Microsoft Entra tenant, identify the root cause of the authentication failures, and preserve all existing configurations.

Please route this case to the appropriate Microsoft Entra identity authentication, Conditional Access, or tenant administrator recovery support team.

Contact information, tenant ID, subscription ID, and account identifiers: Available upon secure request.

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-10-22T07:45:36.2033333+00:00

    Because both Global Administrators are inaccessible and the working user cannot modify Conditional Access, contact Microsoft customer support by phone and request recovery of the existing tenant after first checking for any surviving privileged or partner access path; Microsoft documents ownership verification and recovery of access to the existing tenant rather than creation of a replacement tenant.^1^

    1. Check the remaining administrative recovery paths

    Do not repeat the browser or standard-user Conditional Access attempts. Check only whether one of these different privileged paths exists:

    • An already-authenticated admin session that still has a valid token and sufficient directory permissions to edit Conditional Access.
    • An accessible emergency-access account.
    • An accessible Privileged Role Administrator (PRA). Have the PRA assign or activate Conditional Access Administrator or Global Administrator for an authorized recovery user.
    • A Microsoft partner/reseller with active GDAP and either Global Administrator or Privileged Role Administrator permissions.

    If the GDAP condition applies, ask the partner to promote the working user to Global Administrator or create a new authorized Global Administrator. Microsoft engagement is not required for that recovery path.^2^

    2. Escalate by phone if no privileged path exists

    Since the portal already offered only unsuitable billing or subscription categories, use Microsoft’s regional customer-support phone route.^3^

    Use this case description:

    Complete Microsoft Entra tenant administrative lockout. Both Global Administrators are unable to sign in after a Conditional Access MFA policy change. No accessible administrator can modify Conditional Access. A standard user can sign in but has no administrative permissions. Request high-assurance tenant ownership verification and recovery of an authorized Global Administrator in the existing tenant. Do not recreate or replace the tenant.

    Provide securely to the support engineer:

    • Tenant ID and verified tenant domain
    • Azure subscription ID and billing evidence
    • Affected administrator user principal names
    • Policy name: CA-L14-Require-MFA-Pilot
    • Approximate UTC timestamps for failed sign-ins
    • Request ID, correlation ID, and AADSTS code from More details, if available
    • Screenshots showing the policy state and sign-in interruption
    • Confirmation that both known Global Administrators are affected
    • Whether emergency access, PRA, active admin sessions, or partner GDAP exist

    Microsoft documents that tenant-lockout recovery uses a high-assurance ownership-verification process and restores designated Global Administrator access to the existing tenant.^1^

    If a partner exists but lacks suitable GDAP, ask the partner whether it can open the service request on your behalf.^2^

    3. Online support is conditional on permissions

    The standard user will not automatically be able to open or investigate this case:

    • An Entra support request generally requires at least Service Support Administrator.^4^
    • An Azure subscription support request requires Owner, Contributor, Support Request Contributor, or equivalent Microsoft.Support/* permission at subscription scope.^5^
    • Sign-in diagnostics require at least Billing Administrator from Diagnose and Solve Problems; using them from sign-in logs also requires Reports Reader.^6^

    Therefore, do not assign roles to the standard user solely to bypass recovery unless an authorized PRA, GA, or GDAP partner performs that assignment.

    4. After access is restored

    1. Open Entra ID → Monitoring & health → Sign-in logs.
    2. Filter by affected username and failure time.
    3. Record the AADSTS code.
    4. Open the event’s Conditional Access tab to identify every evaluated policy; also review Authentication Details. This distinguishes the pilot policy from another Conditional Access or MFA-registration requirement.^7^
    5. If CA-L14-Require-MFA-Pilot is confirmed responsible, record/export its original configuration, then change Enable policy from On to Report-only and save. This stops enforcement.^8^

    Security warning: Report-only disables enforcement and may permit access the policy was intended to restrict. Make this change only through an authorized privileged account, minimize the recovery window, monitor sign-ins, validate administrator authentication, and promptly restore or replace the control.

    Finally, create at least two cloud-only emergency-access accounts, give them permanent active Global Administrator assignments, use phishing-resistant credentials, exclude them from policies that block or restrict sign-in, monitor their use, and test them regularly.^9^

    References

    1. Plan for tenant recoverability
    2. Preventing tenant lockouts
    3. Contact Microsoft customer support
    4. Find help and get support for Microsoft Entra
    5. Create an Azure support request
    6. What is the Sign-in diagnostic in Microsoft Entra ID?
    7. Troubleshoot sign-in problems with Conditional Access
    8. Conditional Access insights and reporting
    9. Manage emergency access accounts in Microsoft Entra ID
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.