URGENT – Complete Entra ID tenant lockout after attack (all accounts deleted)

Question

delete

delete

delete

delete

delete

delete

delete

delete

delete

delete

Answer 1

Hello @ABO

Welcome to Q&A forum!

In this situation, I understand that the issue is directly impacting your business and you want to resolve it as quickly as possible. I can confirm that this type of problem can be resolved once you are able to show ownership of your tenant when contacting Microsoft Data Protection through the official support channel.

However, because there are many similar urgent cases and the team is currently handling a high volume of requests, they may need additional time to process your case and schedule a review. If you have already opened a support ticket, please share the ticket ID with me so I can help check its status.

Additionally, since we are only forum moderators, we are not authorized to access any backend data due to privacy and policy restrictions. What we can do is guide you through workarounds in case Microsoft’s support phone lines are delayed or if it is difficult to reach Microsoft Engineering directly.

Another work around

If you still cannot reach to agent, there is still a workaround, you might consider registering for a new tenant by signing up for a trial subscription. This would allow you to create a new tenant following the prompts provided. Once set up, you can access the admin console of the new tenant and submit a support ticket requesting to speak with the Data Protection team on behalf of your previous tenant.   

For detailed guidance, to set up a new tenant, please follow these steps:    

• Visit this following link and choose any plan and click try for free to start a free trial: Microsoft 365 Business Plans and Pricing | Microsoft 365
• Follow the guided setup process to create a new account for a new tenant.

Once your tenant is created, you should be able to access the support portal and submit your ticket without further issues 

Ticket Support: In the Microsoft 365 Admin Center->Support->Help & Support. You can raise support ticket In Microsoft Admin Center by this link:

https://admin.microsoft.com/#/support/requests   

After completing them, you will receive an email appointment for a meeting to review this issue professionally together.

Thank you for your understanding in this matter.

---

If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in "our documentation" to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

In a situation where all admin and user accounts have been deleted from your Microsoft Entra ID tenant, and you have no access left, the fastest official way to trigger an emergency tenant recovery is to contact Microsoft Support directly. Since you mentioned that you have already opened a support case, it is crucial to escalate the urgency of your case by providing them with proof of domain ownership, tenant ID, and any relevant audit logs that confirm the incident.

Additionally, if you have any emergency access accounts set up previously, you may use those to regain access. However, if no such accounts exist, your best course of action is to continue to follow up with Microsoft Support, emphasizing the critical nature of your situation. They can guide you through the recovery process, which may involve verifying your identity and restoring access to your tenant.

Keep in mind that recovery processes can take time, so it is essential to maintain communication with Microsoft Support for updates on your case.

---

References:

• Manage emergency access accounts in Microsoft Entra ID
• Understanding Microsoft 365 support case creation and data access