Tenant lockout

Question

Tenant lockout

Jens Larsson 0

Jag kommer inte åt mitt konto från min nya dator. SMS-verifiering funkar inte. Måste återställa MFA säger Copilot. Hur gör jag?

VEMULA SRISAI 13,030 Reputation points Microsoft External Staff Moderator

2026-03-06T13:53:40.1066667+00:00

Jens Larsson Para que possamos ajudá-lo melhor e encaminhar este caso para a Equipe de Proteção de Dados da Microsoft, precisamos de algumas informações adicionais. Como isso envolve Informações de Identificação Pessoal (PII), solicitamos que você compartilhe os seguintes detalhes somente por mensagem privada (não publique publicamente):
VEMULA SRISAI 13,030 Reputation points Microsoft External Staff Moderator

2026-03-09T13:52:39.8333333+00:00

Jens Larsson could you please share the requested details in private message.
Jens Larsson 0 Reputation points

2026-03-10T13:49:37.29+00:00

What are the requested details? And how do I send a private message?
VEMULA SRISAI 13,030 Reputation points Microsoft External Staff Moderator

2026-03-10T14:45:27.9933333+00:00

Jens Larsson Please see the below screenshot for your reference:
VEMULA SRISAI 13,030 Reputation points Microsoft External Staff Moderator

2026-03-17T11:05:17.3833333+00:00

**Jens Larsson**Error AADSTS16000 is thrown when the user not found in the tenant used for authentication. In your case, this error usually occurs when you sign in to Azure Portal using your personal account which is not added as an external/guest user to an Azure AD tenant. Due to this, you by default get connected to the Microsoft Services tenant.

Since you are connected to the Microsoft Services tenant as a standard user with restricted access, you cannot perform actions such as creating new users, groups, enterprise applications, and so on. To perform administrative actions, you must have administrative access to the tenant.

For this purpose, you need to create your own tenant rather than using the Microsoft Services tenant. When you create a new tenant, you by default become the Global Administrator of the new tenant and have full access to all the options in that tenant.

To create a new tenant, open in-private/incognito browser window (just to avoid SSO), access https://azure.microsoft.com/en-us/free/ to create a free Azure account.

Once the new account is created, you should be able to see and switch to the new tenant by clicking on the settings icon as highlighted below:

In some cases, the user might already have an active session that uses a different personal account than the one that's intended to be used. Or they have a session that uses their organization account although they intended to use a personal guest account (or vice versa).

In that scenario, try signing in to the Azure Portal trough a tenant-specific URL using the following format:

https://portal.azure.com/<tenant domain name>

Eg.

https://portal.azure.com/constoso.onmicrosoft.com
Jens Larsson 0 Reputation points

2026-03-17T12:56:45.6866667+00:00

I can't create a free account since my e-mail is already used for my present account. I have used it both for a professional and a personal account.

I would like to delete the personal account if that's possible, but my main concern is accessing the professional account in order to access M365-apps etc. from a new computer.
VEMULA SRISAI 13,030 Reputation points Microsoft External Staff Moderator

2026-03-20T15:00:39.4833333+00:00
Jens Larsson Thank you for the clarification. This issue is not related to creating a new tenant or a free Azure account. It’s an access and MFA problem with your work (organization) account, especially since the same email is used for both a personal and a work Microsoft account.

To regain access to your professional M365 account:

Sign in via https://portal.office.com and make sure you select “Work or school account”, not the personal account.

If SMS MFA is not working on your new computer, the MFA methods must be reset by an administrator in your organization.

After the admin resets MFA, you can re‑register authentication methods on your new device and regain access to M365 apps.

Deleting the personal account is not required and will not restore access to the work account. These are separate identities.
VEMULA SRISAI 13,030 Reputation points Microsoft External Staff Moderator

2026-03-24T05:42:28.8266667+00:00

Jens Larsson I’m following up on my previous response to see if it helped. Please feel free to reach out if you need any further assistance.I’m happy to help

2 answers

Your answer

VEMULA SRISAI 13,030 Reputation points Microsoft External Staff Moderator

2026-03-06T13:53:40.1066667+00:00

Jens Larsson Para que possamos ajudá-lo melhor e encaminhar este caso para a Equipe de Proteção de Dados da Microsoft, precisamos de algumas informações adicionais. Como isso envolve Informações de Identificação Pessoal (PII), solicitamos que você compartilhe os seguintes detalhes somente por mensagem privada (não publique publicamente):
VEMULA SRISAI 13,030 Reputation points Microsoft External Staff Moderator

2026-03-09T13:52:39.8333333+00:00

Jens Larsson could you please share the requested details in private message.
Jens Larsson 0 Reputation points

2026-03-10T13:49:37.29+00:00

What are the requested details? And how do I send a private message?
VEMULA SRISAI 13,030 Reputation points Microsoft External Staff Moderator

2026-03-10T14:45:27.9933333+00:00

Jens Larsson Please see the below screenshot for your reference:
VEMULA SRISAI 13,030 Reputation points Microsoft External Staff Moderator

2026-03-17T11:05:17.3833333+00:00

**Jens Larsson**Error AADSTS16000 is thrown when the user not found in the tenant used for authentication. In your case, this error usually occurs when you sign in to Azure Portal using your personal account which is not added as an external/guest user to an Azure AD tenant. Due to this, you by default get connected to the Microsoft Services tenant.

Since you are connected to the Microsoft Services tenant as a standard user with restricted access, you cannot perform actions such as creating new users, groups, enterprise applications, and so on. To perform administrative actions, you must have administrative access to the tenant.

For this purpose, you need to create your own tenant rather than using the Microsoft Services tenant. When you create a new tenant, you by default become the Global Administrator of the new tenant and have full access to all the options in that tenant.

To create a new tenant, open in-private/incognito browser window (just to avoid SSO), access https://azure.microsoft.com/en-us/free/ to create a free Azure account.

Once the new account is created, you should be able to see and switch to the new tenant by clicking on the settings icon as highlighted below:

In some cases, the user might already have an active session that uses a different personal account than the one that's intended to be used. Or they have a session that uses their organization account although they intended to use a personal guest account (or vice versa).

In that scenario, try signing in to the Azure Portal trough a tenant-specific URL using the following format:

https://portal.azure.com/<tenant domain name>

Eg.

https://portal.azure.com/constoso.onmicrosoft.com
Jens Larsson 0 Reputation points

2026-03-17T12:56:45.6866667+00:00

I can't create a free account since my e-mail is already used for my present account. I have used it both for a professional and a personal account.

I would like to delete the personal account if that's possible, but my main concern is accessing the professional account in order to access M365-apps etc. from a new computer.
VEMULA SRISAI 13,030 Reputation points Microsoft External Staff Moderator

2026-03-20T15:00:39.4833333+00:00

Jens Larsson Thank you for the clarification. This issue is not related to creating a new tenant or a free Azure account. It’s an access and MFA problem with your work (organization) account, especially since the same email is used for both a personal and a work Microsoft account.

To regain access to your professional M365 account:

Sign in via https://portal.office.com and make sure you select “Work or school account”, not the personal account.

If SMS MFA is not working on your new computer, the MFA methods must be reset by an administrator in your organization.

After the admin resets MFA, you can re‑register authentication methods on your new device and regain access to M365 apps.

Deleting the personal account is not required and will not restore access to the work account. These are separate identities.
VEMULA SRISAI 13,030 Reputation points Microsoft External Staff Moderator

2026-03-24T05:42:28.8266667+00:00

Jens Larsson I’m following up on my previous response to see if it helped. Please feel free to reach out if you need any further assistance.I’m happy to help

Answer 1

Hello @Jens Larsson,

If you're trying to sign in to your Azure tenant but cannot complete the login due to MFA (which requires a 6-digit OTP code), you will need assistance from another Global Administrator to reset your MFA registration.

Please share the following steps with another Global Administrator in the tenant to reset your MFA settings:

Sign in to the Microsoft Entra admin center as an Authentication Administrator (or higher).
Navigate to Identity > Users > All users.
Select the affected user, then choose Authentication methods.
At the top of the window, click on "Require re-register MFA".

Screenshot of manage authentication methods from the Microsoft Entra admin center.

After this is done, you should be able to sign in again and register a new MFA authentication method when prompted.

If you're the only Global Administrator in the tenant, this qualifies as a tenant lockout scenario. In that case, we’ll need to involve Microsoft’s Data Protection team through a support ticket to help restore access.

To proceed, I’ll need a few details from you. Since this information contains personally identifiable information (PII), please send the following via private message:

Contact phone number (with country code)
Contact email address
Affected Global Admin email address
Country
Time zone

Once received, we can connect offline to discuss further steps and assist in resolving the issue.

Answer 2

Eftersom SMS‑verifiering inte fungerar och kontot är låst av MFA krävs hjälp av en administratör eller Microsoft Support, beroende på om det finns fler globala administratörer i din tenant.

Gör så här steg för steg:

Prova andra inloggnings-/MFA‑metoder
- På inloggningssidan, när verifiering efterfrågas, välj länken för att använda en annan metod (t.ex. "Sign in another way" eller "Other verification options") om den visas.
- Försök med alternativ metod (t.ex. annan telefon, kontorstelefon, e‑postkod) om sådana är registrerade.
Om du är vanlig användare (det finns andra administratörer)
- Kontakta din organisations globala administratör/IT‑helpdesk och be dem:
  - Kontrollera att ditt telefonnummer/e‑post i säkerhetsinformationen är korrekt.
  - Kräva omregistrering av MFA för ditt konto (Require re‑register MFA) så att du kan lägga till nya MFA‑metoder.
  - Kontrollera i Microsoft Entra ID att ditt konto inte är blockerat för inloggning.
Om du är enda globala administratören (tenant lockout)
- Detta är ett klassiskt tenant‑lockout‑scenario där ingen annan admin kan återställa din MFA.
- Lösning enligt rekommenderad praxis är att involvera Microsofts Data Protection‑team via en supportärende:
  1. Ring Microsofts globala kundtjänst ("Customer service phone numbers - Microsoft Support").
  2. Beskriv tydligt att:
    - Det gäller en Microsoft 365/Entra‑tenant för företag.
    - Du är enda globala administratören.
    - Du är utelåst p.g.a. MFA (ny telefon, SMS fungerar inte, Authenticator går inte att använda).
    - Du behöver ett MFA‑reset/återställning av autentiseringsmetoder för admin‑kontot.
  3. Be att ärendet eskaleras till Data Protection‑teamet för identitetsverifiering och återställning av åtkomst.
- Om det är svårt att nå rätt supportkanal kan en alternativ väg vara att skapa en tillfällig ny tenant (test/prövoversion) och därifrån öppna ett supportärende till Data Protection‑teamet för den låsta tenanten, enligt beskrivningen i kontexten.
När åtkomst är återställd
- Logga in och registrera om dina MFA‑metoder (ny telefon, Authenticator‑app, SMS, etc.).
- Överväg att lägga till fler än en MFA‑metod (t.ex. både Authenticator och SMS) och att skapa minst ett extra globalt admin‑konto (break‑glass‑konto) för att undvika framtida tenant‑lockout.

References:

Share via

Tenant lockout

2 answers

Your answer