A cloud-based identity and access management service for securing user authentication and resource access
The error interaction_required: AADSTS5000225: This tenant has been blocked due to inactivity means the Microsoft Entra tenant is in an inactive, blocked state due to tenant lifecycle policies. While blocked, sign-in to Azure and Azure DevOps is prevented.
Key points from the documented behavior:
- A tenant that has been inactive for more than 200 days past the billing cycle can be blocked from login (AADSTS5000225).
- After the login block is applied, there is a 20‑day grace period during which the tenant can still be reactivated.
- If the tenant remains blocked for more than 20 days, it is permanently deleted and cannot be recovered.
To proceed:
- Determine how long the tenant has been inactive.
- If more than 20 days have passed since the block was applied, the tenant is permanently deleted and cannot be restored.
- If the tenant has been blocked for less than 20 days:
- A tenant administrator must contact Microsoft support to request reactivation. Follow the guidance under “Tenant inaccessible due to inactivity” in the referenced Q&A articles.
- As a workaround for access issues while dealing with the blocked tenant:
- Sign in directly with the tenant in the Azure portal URL, for example:
-
https://portal.azure.com/<TenantId>or -
https://portal.azure.com/<yourTenantName>.onmicrosoft.com
-
- If the original tenant cannot be recovered, create a new tenant from the Entra admin center (
https://entra.microsoft.com/→ Entra ID → Overview → Manage tenants → Create new tenant) and then use that new tenant domain or ID in the Azure portal URL.
- Sign in directly with the tenant in the Azure portal URL, for example:
If the tenant is within the 20‑day reactivation window, resolution ultimately requires working with Microsoft support as tenant admin; self-service alone cannot remove the AADSTS5000225 block.
References: