Microsoft 365 tenant locked out due to conditional access requirement

Jon Lee 20 Reputation points
2026-04-06T04:46:14.57+00:00

None of our global admins are able to login to our tenant. Each login blocked (error 53003). I know the policy(Conditional access) that is causing this (it was a recommendation) but no one can login to remove it as they don't have access. The issue is the policy "Phishing-resistant multifactor authentication for admins" that I can find on https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies/menuId//fromNav/Identity?Microsoft_AAD_IAM_legacyAADRedirect=true but only read only with a secondary non global admin account. We cannot perform any admin tasks on the tenant. Data Protection higher-tier team has confirmed that this issue falls outside of their scope of support and want me to call Microsoft Commercial team. Tried Phone support(commercial team) hangs up on me before I can talk to a human and tells me that my account is not global admin. I have contacted microsoft partner when sold the microsoft 365 subscription to me and was told they can't remove the policy(Conditional access). It has been almost 3 weeks and I don't know what to do at this point, any help on how to get the support I need would be very much appreciated. Thank you very much!

Microsoft 365 and Office | Subscription, account, billing | For business | Other
0 comments
Answer accepted by question author
Huy-K 13,990 Reputation points Microsoft External Staff Moderator
2026-04-06T06:16:03.09+00:00

Dear @Jon Lee,

Based on what you described, none of your Global Admins can currently access the Microsoft 365 admin center due to Conditional Access issue. Moreover, the Data Protection Team also confirmed this issue falls outside of their scope of support. Therefore, the practical next step is to contact your Microsoft partner / reseller (CSP) and ask them to open a support ticket on your behalf. An engineering agent will reach out and help you in details.

As a moderator, I do not have the tools to investigate your specific account directly because this is a user-to-user support forum. Our role is limited to providing technical support on reported issues, requests, or ideas. I sincerely apologize for this inconvenience and thank you for your understanding.

Was this answer helpful?

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-04-06T04:46:37.4933333+00:00

    Error 53003 indicates users are being blocked by a Conditional Access policy. In this case, all global admins are locked out by the “Phishing-resistant multifactor authentication for admins” policy and cannot change it.

    From the available guidance, the supported recovery paths are:

    1. Use another admin who is not blocked
      • If there is any other administrator account (for example, a break-glass/emergency access account or another role with Conditional Access permissions) that can still sign in, that account can disable or modify the blocking policy:
        1. Sign in to the Microsoft Entra admin center.
        2. Go to Entra ID > Enterprise apps > Conditional Access.
        3. Select the problematic policy.
        4. Temporarily set Enable policy to No and Save.
      • This is the standard remediation when at least one admin is not locked out.
    2. If all admins are locked out due to Conditional Access
      • When no admin can sign in because of a misconfigured Conditional Access policy, the documented path is:
        1. Check if there are any other admins in the organization who are not blocked yet. If so, they must disable the policy that is affecting sign-in.
        2. If no admin in the organization can update the policy, submit a support request so Microsoft support can review and, after confirming, update the Conditional Access policies that prevent access.
      • This scenario is explicitly called out as “locked out because of an incorrect setting in a Conditional Access policy.”
    3. Ensure emergency access / break-glass accounts exist (for future prevention)
      • Microsoft recommends having at least two emergency access admin accounts that are:
        • Excluded from Conditional Access policies (including MFA requirements).
        • Used only for emergencies.
      • These accounts are specifically intended to prevent tenant lockouts caused by Conditional Access or MFA misconfiguration.
    4. Partner / GDAP considerations
      • For tenants managed by a partner using GDAP, partners are expected to:
        • Ensure there is Global Admin redundancy.
        • Create break-glass accounts excluded from Conditional Access.
        • Avoid blanket policies that apply to all admins and always test policies before deployment.
      • If a partner has GDAP roles with sufficient permissions and is not blocked by the policy, they can sign in and disable or adjust the Conditional Access policy.

    Given the context, the only supported technical resolution is for an account with sufficient admin rights that is not blocked by Conditional Access (either an internal admin, emergency access account, or a partner/GDAP admin) or Microsoft support (via a support request) to disable or modify the offending policy. There is no documented self-service method to bypass a blocking Conditional Access policy when all admins are locked out.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.