How to fix AADSTS500022 Access to tenant ... denied ?

Question

How to fix AADSTS500022 Access to tenant ... denied ?

Иван Бобров 0

Suddenly today morning all user in tenant received error.
AADSTS500022: Access to tenant ... denied
Last night all worked fine, no configuration changes were made during last few days.
Now it looks like tenant is absent.
How to fix it and what happened ?
I am admin in this tenant, so don't answer me "ask your admin" :-)

Errror details for one login attempt are below: Request Id: fad9d9f2-5add-42f4-a41e-4c6269002001 Correlation Id: ff4de223-3c39-4bf7-af63-1e9086397d5e Timestamp: 2024-02-13T06:48:50Z Message: AADSTS500022: Access to ... tenant is denied. App name: OfficeHome Device platform: Windows 10 Device state: Unregistered IP address: 50.7.93.85

0 comments

1 answer

Your answer

Answer 1

Sandeep G-MSFT 21,151 Microsoft Employee Moderator

@Иван Бобров
Thank you for posting this in Microsoft Q&A.There are multiple reasons for the error that you are receiving.

This error is caused due to conditional access policy configured in your tenant. In the above error I see that you are trying to access Azure resources from Windows 10 device which is unregistered.

Looks like you have configured a conditional access policy which requires device to be registerd while access any Azure resources.

It might be possible that your device is registered with Azure AD. But still, you are getting device as unregistered.

This is due to the client that you are using to access Azure portal.

You can try to use different browsers and check if you are able to access Azure services.

Also, possibility of below reason can be true as well,

Usually, this error AADSTS500022 indicates that the tenant restriction feature is configured and that the user is trying to access a tenant that isn't in the list of allowed tenants specified in the header Restrict-Access-To-Tenant.Large organizations that emphasize security want to move to cloud services like Microsoft 365, but need to know that their users only can access approved resources. Traditionally, companies restrict domain names or IP addresses when they want to manage access. This approach fails in a world where software as a service (or SaaS) apps are hosted in a public cloud, running on shared domain names like outlook.office.com and login.microsoftonline.com. Blocking these addresses would keep users from accessing Outlook on the web entirely, instead of merely restricting them to approved identities and resources.

The Microsoft Entra solution to this challenge is a feature called tenant restrictions. With tenant restrictions, organizations can control access to SaaS cloud applications, based on the Microsoft Entra tenant the applications use for single sign-on.

Reference link: https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/tenant-restrictions#how-it-works

Let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Ivan Bobrov 0 Reputation points

2024-02-13T17:26:48.8+00:00
@Sandeep G-MSFT

Thanks for your answer, but ...
We identified the root cause:

domain linked to tenant was locked for short time (due to some mistake of admin) and during this period office 365 blocked access to tenant

now linked domain (vtb.education) is unlocked and transferred to another registrant , but access to tenant is still blocked

What I should do to unblock access to tenant ?

Thanks in advance for your reply and may be help
Sandeep G-MSFT 21,151 Reputation points Microsoft Employee Moderator

2024-02-14T04:16:56.29+00:00

@Иван Бобров

I am glad that you were able to identify the issue. As you mentioned above your domain was locked due to one of the admin tasks in the tenant.

Now that your domain/tenant registrant has changed and you still do not have access to your tenant, you will have to follow below instructions and get the admin account unblocked from the tenant.

If you are the only global admin on the account and are blocked entirely, you can reach out to our support team. You can look into below article to get support numbers depending on your country.

https://support.microsoft.com/en-us/topic/global-customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2

or creating a ticket through a different account: https://learn.microsoft.com/en-us/microsoft-365/admin/get-help-support?view=o365-worldwide#phone-support

Create a ticket with Microsoft support team. Give them the tenant ID which is locked out in your description. Tell them that no admin account has access anymore and your partners also have no access anymore.

Once you create a ticket with support team you will have to work with our data protection team. You will have to first prove your identity against your tenant for security purpose. Post that this team will help you with help you in getting access to your tenant or unlock your account depending on your scenario.

Also, for the future, you can create an emergency access account (break glass) in Azure AD. This account will help prevent being accidentally locked out of your Azure Active Directory (Azure AD) organization because you can't sign in for any reason.

https://docs.microsoft.com/en-us/azure/active-directory/roles/security-emergency-access

Let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Ivan Bobrov 0 Reputation points

2024-02-14T06:50:11.3766667+00:00

@Sandeep G-MSFT Thanks a lot for your detailed instructions, but ... I just talked to local support team by phones you provided. I told them that no admin account has access anymore and gave them the tenant ID which is locked out. The answer was: "according out system your tenant is locked out and we couldn't create ticket for locked out tenant". It looks like dead end :-( May be it is another way to create ticket ? Thanks for your help !

Share via

How to fix AADSTS500022 Access to tenant ... denied ?

1 answer

Your answer