Tenant Lockout Issue

Question

Hi,

I'm an MCT trainer, and I changed my phone, so I ended up in a tenant lockdown situation.

I can no longer access my VS Code subscription attached to my MCT account,

Can you please assist in recovering my access and using my subscription?

Thanks,

Regards,

Mouad.

Answer 1

Hello @Mouad Mikou,

As discussed over chat, you were able to log in to your Azure tenant at admin.cloud.microsoft.com. To reset your MFA, we created a new user with Global Administrator rights. Using this new account to log in to the Azure Portal, we successfully reset the MFA for your personal account, which had been added as a guest account in the tenant.

Below are the steps we followed to reset the MFA:

1. Sign in to the Microsoft Entra admin center.
2. Navigate to Identity > Users > All users.
3. Select the affected user, then choose Authentication methods.
4. At the top of the window, click on "Require re-register MFA".

After this is done, you should be able to sign in again and register a new MFA authentication method when prompted.

Answer 2

To recover access and use the Visual Studio subscription attached to the MCT account, two separate issues must be addressed: the tenant lockout and the MCT Visual Studio subscription.

1. Resolve the tenant lockout (MFA/tenant access)

• If there is another global administrator in the tenant:
  • Ask that admin to reset the account’s MFA so sign-in can be completed again.
  • They should:
    1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com).
    2. Go to Users → All users and select the locked-out account.
    3. Open Authentication methods.
    4. Select Require re-register multifactor authentication.
    5. After this, sign in again and reconfigure Microsoft Authenticator on the new phone.
• If there is no other global administrator and this is a business/organization tenant:
  • This is a tenant lockout scenario where only the Microsoft Data Protection team can help.
  • Contact Microsoft support by phone using the global customer service numbers and request escalation to the Data Protection/Tenant Recovery team for an admin locked out due to MFA/Authenticator change. They have tools and processes to verify identity and restore access when there is only one admin.
  • If the tenant is provided through a partner/reseller, the partner can open a support request on behalf of the tenant.

2. If the tenant itself is blocked due to inactivity

• If sign-in fails with error AADSTS5000225: This tenant has been blocked due to inactivity, the tenant has been marked inactive.
• A tenant blocked for inactivity can be reactivated only within 20 days of entering the inactive state. After 20 days, it is permanently deleted and can’t be recovered.
• If it has been less than 20 days since the block:
  • An administrator must contact Microsoft using the global support phone numbers and request tenant reactivation, referencing the inactivity block.

3. Restore access to the Visual Studio subscription as an MCT

• Once tenant and sign-in issues are resolved and sign-in works again, the Visual Studio subscription should be accessible with the usual sign-in identity.
• If there are still problems specifically with the Visual Studio subscription (for example, subscription not visible or access lost even though sign-in works):
  • As an MCT, submit a ticket via the MCT support portal at https://aka.ms/NewMCTSupport.
  • Include in the ticket:
    1. Full name and MCT ID.
    2. Detailed description of the issue (tenant lockout, phone change, MFA reset, and current status).
    3. Any error messages or screenshots.
    4. The email address associated with the Visual Studio subscription account.
  • The MCT support team will review and help restore or confirm access to the Visual Studio subscription.

4. Important notes

• If the tenant has been blocked for inactivity for more than 20 days and is already deleted, it cannot be recovered; a new tenant and new assignments would be required.
• If the identity used for the Visual Studio subscription was deleted or changed by an admin, access to the subscription can be impacted; ensure the sign-in identity used for the subscription still exists and is not anonymized.

---

References:

• Tenant inaccessible due to inactivity
• Discover your Microsoft cloud footprint FAQ
• Preventing tenant lockouts
• Can't use Azure Multi-Factor Authentication to sign in to cloud services after you lose your phone or the phone number changes
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• Global Admin Locked out - Microsoft Q&A
• Microsoft authenticator sending me into a spiral - Microsoft Q&A
• Error message: interaction_required: AADSTS5000225: This tenant has been blocked due to inactivity - Microsoft Q&A
• Downloading and activating software
• Troubleshooting suggestions for signing in to Visual Studio subscriptions