A cloud-based identity and access management service for securing user authentication and resource access
The error AADSTS5000225: This tenant has been blocked due to inactivity means the Microsoft Entra tenant backing the Azure subscription has been put into an inaccessible state due to inactivity.
Key points from the tenant lifecycle behavior:
- When a tenant is marked inaccessible due to inactivity, sign-in to that tenant is blocked and the error you see is expected.
- Administrators can request reactivation only within 20 days of the tenant entering this inactive state.
- If the tenant remains inaccessible for more than 20 days, it is deleted and cannot be recovered.
To proceed:
- If the tenant entered inactivity less than 20 days ago
- A tenant administrator must contact Microsoft support and request reactivation of the tenant.
- Use the global support phone numbers listed at the Microsoft support page referenced in the documentation.
- Do not open multiple support requests for the same issue; wait for the decision on the first case.
- If the tenant has been inactive for more than 20 days
- The tenant will have been deleted and is not recoverable.
- In this case, a new tenant must be created and used going forward.
- Alternative sign-in attempts (if still within the 20‑day window)
- Try accessing the Azure portal directly with the tenant identifier or tenant name in the URL, for example:
-
https://portal.azure.com/<TenantId> -
https://portal.azure.com/<yourTenantName>.onmicrosoft.com
-
- If sign-in still fails with the same error, proceed with contacting Microsoft support as above.
- Try accessing the Azure portal directly with the tenant identifier or tenant name in the URL, for example:
- If a new tenant is needed
- Sign in at
https://entra.microsoft.com/with the same Microsoft account (if it still works at the account level) and go to Entra ID → Overview → Manage tenants. - Create a new tenant and note its domain name (for example,
newtenant.onmicrosoft.com). - Then access the Azure portal using the new tenant domain in the URL, for example:
https://portal.azure.com/newtenant.onmicrosoft.com. - Use this new tenant to manage Azure resources going forward.
- Sign in at
If the account itself is locked out (for example, no global admin access or MFA issues) and not just the tenant, the Microsoft Data Protection teams can assist via a support ticket, but tenant reactivation still must occur within the 20‑day window.
References: