Full tenant lockout – Locked All the Users and Admin Out of Microsoft 365 Tenant – No Global Admin Access

Question

I'm a new Global Admin in the company where i work and taking over, without previous documentation our tenant settings.

Accidentally locked out all the users of the company after changing a conditional access policy.
This means we are completely down and cannot use our products which is office 365 for business suite.

I tried contacting the global number support and they create a ticket with C severity even though I mentioned that we are down completely because no one has access to the tenant anymore nor the users or admins.

Could you please help with this? Any new advice on how they can prioritize my ticket.

Answer 1

Because the Conditional Access change has locked out all admins and users, recovery must go through Microsoft support; there’s no self-service fix once no admin can sign in.

Use these steps to move things forward as quickly as possible:

1. Confirm there is truly no unblocked admin account
   • If there is any other Global Administrator or emergency/break-glass account that can still sign in, that admin can disable or edit the blocking Conditional Access policy directly.
   • Guidance: another admin with access can disable the policy that’s affecting sign-in. If such an admin exists, have them sign in to the Microsoft Entra admin center and turn off or scope down the problematic policy.
2. If no admin can sign in – rely on Microsoft support
   When all admins are blocked, Microsoft must intervene on the tenant:
   • Open or continue the existing support request as a tenant lockout / Conditional Access lockout case.
   • Use the documented path to submit a support request for Conditional Access lockout: submit a support request.
   • For Microsoft 365 business tenants, use the regional phone numbers listed here: Find Microsoft 365 for business support phone numbers by country or region.
3. Escalate the severity correctly
   From the context, Microsoft treats full tenant lockout as a data-protection / access issue that must be handled by support teams (Data Protection / Microsoft 365 support). To help get the right severity and routing when you call or update the ticket:
   • Clearly state:
     • All Global Administrators are locked out.
     • All users are locked out of Microsoft 365 (business down).
     • The cause is a Conditional Access policy that blocks all sign-ins.
   • Ask explicitly for escalation as a tenant lockout / administrator lockout and to involve the Microsoft 365 Data Protection team or equivalent escalation team.
   • Reference that Microsoft support can, after verification, update Conditional Access policies that prevent access.
4. While waiting on support
   • Do not create additional conflicting tickets; the guidance is to avoid multiple assistance requests while a tenant-access case is in progress.
   • Ensure someone who can answer verification questions and provide business documentation is available when support calls back (they will need to validate tenant ownership and identity before changing policies).
5. After recovery – prevent future lockouts
   Once access is restored, implement the recommended protections:
   • Create at least two cloud-only emergency access (break-glass) accounts with Global Administrator, excluded from all Conditional Access policies.
   • Ensure at least two Global Admin accounts with different credentials and MFA methods.
   • Review Conditional Access policy design: avoid blanket policies that apply to all admins; always exclude break-glass accounts and test policies before broad deployment.
   • Configure and document Self-Service Password Reset (SSPR) and recovery procedures for admins.

These steps do not bypass Microsoft; they align with the documented process where Microsoft support, after verification, can adjust Conditional Access when no admin remains able to sign in.

---

References:

• Troubleshoot sign-in problems with Conditional Access
• Preventing tenant lockouts
• Checklist for Tenant Setup and GDAP Management
• Create a resilient access control management strategy with Microsoft Entra ID
• Troubleshoot sign-in issues and account access problems
• Tenant access recovery