All our admin accounts are locked out of microsoft services due to faulty conditional access policies. The policy was set to enforce use of Hybrid domain joined devices however we do not have any on-prem domain controller. We have our organisation operationally fully with Azure AD registered devices and Intunes managed devices. Hence none of the admin are anymore able to login to any of the microsoft portals since it is considering out Azure Registered devices are personal devices. Also, since none of the Microsoft portals are available, we are not able to register a support ticket for this issue. Need help as to how can be we go ahead with it and reporting it to Microsoft and get it resolved at the earliest.

@Laukik Pandurang Tikam Thank you for your detailed post! When it comes to all of your Admins being locked out due to an incorrect setting in a Conditional Access policy, you'll have to: Check if there are other administrators in your organization that aren't blocked yet. An administrator with access to the Azure portal can disable the policy that is impacting your sign-in. If none of the administrators in your organization can update the policy, submit a support request . Microsoft support can review and upon confirmation update the Conditional Access policies that are preventing access. Note: If you can access your tenant with a non-Azure AD Admin - if that user has the Owner, Contributor, Support Request Contributor RBAC role, or a custom role with Microsoft.Support/*, at the subscription level, they can create a Support request. If you're unable to access your tenant with any users, you'll have to reach out to our Global Customer Service phone number(s) so their team can look into your issue and potentially give you access to your tenant. Optionally, you can try reaching out to our Azure Data Protection team for further assistance - (866-807-5850). For future reference, I'd also recommend creating and managing an emergency access account in Azure AD , this will help prevent being accidentally locked out of your Azure Active Directory (Azure AD) organization because you can't sign in or activate another user's account as an administrator. Additional Links: What to do if you're locked out of the Azure portal? Troubleshooting sign-in problems with Conditional Access If you have any other questions, please let me know. Thank you for your time and patience throughout this issue. ---------- Please remember to " Accept Answer " if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Hi, Sorry to hear this, however a break glass account or exclusion should been in place before you implement CA policies also you get a recommendation when you configure CA policies, anyways for next release you can prepare in advance and save yourself from this situation. However for now you can try the global support number or contact your Microsoft Account Manager - TAM for assistance on this issue. global-customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2 == Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

All admins locked out due to faulty conditional access policy. What to do?

Accepted answer

JamesTran-MSFT 36,481 Reputation points Microsoft Employee

2022-09-13T23:29:35.377+00:00
@Laukik Pandurang Tikam
Thank you for your detailed post!

When it comes to all of your Admins being locked out due to an incorrect setting in a Conditional Access policy, you'll have to:

Check if there are other administrators in your organization that aren't blocked yet. An administrator with access to the Azure portal can disable the policy that is impacting your sign-in.

If none of the administrators in your organization can update the policy, submit a support request. Microsoft support can review and upon confirmation update the Conditional Access policies that are preventing access.
Note: If you can access your tenant with a non-Azure AD Admin - if that user has the Owner, Contributor, Support Request Contributor RBAC role, or a custom role with Microsoft.Support/*, at the subscription level, they can create a Support request.

If you're unable to access your tenant with any users, you'll have to reach out to our Global Customer Service phone number(s) so their team can look into your issue and potentially give you access to your tenant. Optionally, you can try reaching out to our Azure Data Protection team for further assistance - (866-807-5850).

For future reference, I'd also recommend creating and managing an emergency access account in Azure AD, this will help prevent being accidentally locked out of your Azure Active Directory (Azure AD) organization because you can't sign in or activate another user's account as an administrator.

Additional Links:
What to do if you're locked out of the Azure portal?
Troubleshooting sign-in problems with Conditional Access

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.
Please sign in to rate this answer.
JamesTran-MSFT 36,481 Reputation points Microsoft Employee

2022-09-14T16:49:17.71+00:00

@Laukik Pandurang Tikam
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

JamesTran-MSFT 36,481 Reputation points Microsoft Employee

2022-09-19T21:11:24.477+00:00

@Laukik Pandurang Tikam
I just wanted to check in and see if you had any other questions?

Laukik Pandurang Tikam 46 Reputation points

2022-09-29T07:17:05.687+00:00

Hello @JamesTran-MSFT , Thank you for the feedback. The was indeed resolved after logging a support request from another account. The issue was resolved by Microsoft Customer Support after a couple of verification calls from the azure data protection team. After the verification was done, we were given access to the accounts by bypassing the CAP for 24-hours. Within this time frame we reverted back the changes to CAP that caused the issue. Thus the issue was resolved.

I would like to mention that the customer support interaction was seamless and the issue was resolved for us within 8 hours.

Thanks again :)

CJ-Latencie 1 Reputation point

2022-10-27T14:27:55.63+00:00

We have the same problem and unfortunately we are NOT having a great experience with Microsoft. It's been 88 days and Microsoft still has not been able to unblock they don't even respond. It's at the point now that we have been unable to receive emails and do business for 3 weeks now. So no one is confused our admin account was blocked July 31st, then in October email stopped working and we are missing important business emails, payment updates, etc. We all know how critical email is to a business but unfortunately Microsoft doesn't care. Yes I know the rules about break glass account, etc. etc. but there is no excuse for ANY service request ticket to take 88+ days, that's 2 days short of 3 months. I continually call and ask for an escalation and nothing, just someone will call you back and then silence. A week ago they told me the issue was priority "A" then silence. It's a joke to Microsoft, as I lose money and business Microsoft treats it as it's no big deal, their company is fine so who cares.

I replied here to ask for help and to rant because this is ridiculous, this is the support I paid for.....

CJ-Latencie 1 Reputation point

2022-11-21T04:00:01.207+00:00

Got it fixed, had to come up with this idea on my own because after months Mindtree (the firm that does the support for Microsoft, that's who you're talking to not actually Microsoft employees) could not figure this out. I simply opened a new ticket requesting one of the other active user accounts be made Global Admin, that took a couple of days with all the verifications but once it was made Global Admin I was able to remove the other admin account from "risky-users" and go on with my business. Thank you to those who helped me complete this workaround and I hope this helps someone else in this situation.

Sajid Ahmed 0 Reputation points

2023-06-10T11:30:39.1966667+00:00

@CJ-Latencie We are in the same situation, all our global admins are locked out due to broken conditional access policy. How did you create a ticket? through a different tenant?

We have an ongoing ticket since past 1 week & still waiting to hear back from data protection team.

How can we request another account to be made global admin?

CJ-Latencie 1 Reputation point

2023-06-11T18:16:10.5033333+00:00

Logon to partner.microsoft.com as the account you want to make Global Admin, it has to be under the same tenant. Once you're in the partner center click the question mark at the top right and then choose "contact support" at the bottom right. Problem Summary=Global admin, Workspace=Account Settings, Problem Type=Become Global Admin for MPN account. Don't do the recommended steps, just choose "create support request" at the bottom of the screen. The rest you should know and you'll have to verify the info THEY HAVE ON FILE when they reach out to you, not what you think it is but what's already there when the MPN account was created. If asked to create or continue the ticket to unblock the current admin(s) say "no I just want to make this account an admin." Also don't delete or remove any admin accounts.

I hope this helps.
Sign in to comment

Share via

All admins locked out due to faulty conditional access policy. What to do?

1 additional answer