Everyone locked out of tenant due to a faulty Conditional Access Policy

Nick Bobak 40 Reputation points
2024-04-25T23:18:45.7933333+00:00

We have been locked out of our tenant for almost 2 weeks now due to a faulty Conditional Access policy. During this week, there have been several conversations with a number of Microsoft support technicians, none of which seemed to have an understanding of the actual issue at hand or able to resolve the issue and all ended up assigning the case to a different team. We know exactly what is wrong and how to fix it. But we need the help of the Data protection team. Since this is a high impact incident and things are moving too slow via the regular support channels, we are trying to get in touch with them through this channel. We came across similar incidents on this forum and saw that they responded quickly. Our current support case number is 2404140040001624.

Microsoft Intune Security
Microsoft Intune Security
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
341 questions
Microsoft Intune
Microsoft Intune
A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.
4,365 questions
Microsoft Entra
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,569 questions
Accepted answer
  1. Givary-MSFT 28,321 Reputation points Microsoft Employee
    2024-05-02T09:39:09.2566667+00:00

    @Nick Bobak Apologies for the delayed response. As per the last update which I have got from my engineering team, we have excluded one of the Global admin accounts from the conditional access policy which caused this lockout.

    This exclusion would be valid for next 24 hrs, would request you to login to your tenant at earliest, make changes to the policy so that others can login/access resources.

    From next time onwards try to have emergency accounts - https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access

    Let me know if you have any further questions, feel free to post back.

    1 person found this answer helpful.
    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,246 Reputation points
    2024-04-25T23:52:59.21+00:00

    Hello, the Data Protection team is usually stacked with several cases related to the same issue. Send an email to azcommunity@microsoft.com with the Subject Attn: Security+Identity for some extra help but bear with me, it's all up to how many cases the DP team is already dealing with.

    That said, it would be a nice idea for Microsoft to strongly suggest and offer automatic break-glass/emergency account creation or ensure they won't get locked. Feel free to support ideas like this: https://feedback.azure.com/d365community/idea/42215546-8a90-ed11-a81b-000d3ae5ae95 so that the product team can consider them.