Switched myself from External to Internal user and lost access to directory

Question

Hello,

I used a personal (not company) Microsoft account for Azure. My account was set as Global Administrator. Now, I was looking into changing MFA login settings and noticed that it was set to External user and then I thought why not set it to Internal. After setting it to Internal, I logged in again and now nothing works in Azure Portal and Entra Admin center.

Answer 1

Hey there, Martin Sven Kovacic

I logged in again and now nothing works in Azure Portal and Entra Admin center.

So that I can try and help or point you in the right direction, please can you answer the following questions:

1. Please can you explain what you see when you try and sign into Azure with your Microsoft account?
2. Do you know your user principle name (UPN) for the account?
3. Is there another administrator for your tenant?

I was looking into changing MFA login settings and noticed that it was set to External user and then I thought why not set it to Internal.

When you convert a Microsoft personal account from an external user to an internal user, the account must be signed in with it's User Principal Name (UPN) because the login workflow changes. The UPN generally is formed using the first part of your Microsoft account email with the #EXT# at the end before the @tenantName.onMicrosoft.com email.

So if I had a test account that was using a Microsoft personal account to join my tenant with their email username being testMicrosoftAccount their username would be testMicrosoftAccount_outlook.com#EXT# followed by the @tenantName.onmicrosoft.com address at the end.

The UPN can be found on the account profile in the Entra ID blade on Azure: https://portal.azure.com/#view/Microsoft_AAD_UsersAndTenants/UserManagementMenuBlade/~/AllUsers

When you click onto a profile, it will show under their name and on the main basic info page.

This is because the account, prior to being converted, would have used the Microsoft account identity to sign in, which you can see on mine under identities, it shows it is using this identity.

So even though I have a standard UPN that I can use to sign into the account with, I just need to sign in with my Microsoft account username because the system checks the Microsoft account identity to validate my login request.

Whereas on my other account, I use for tests, the identity is showing as my tenant. This would mean I would need to use the password set for the identity on Entra, on my tenant. You can learn more about this here: https://learn.microsoft.com/en-us/entra/identity/users/convert-external-users-internal

From what you are describing, it may be that you are signing into your Microsoft account, as normal, but the Microsoft account is no longer assigned to a profile on your tenant. Thus, the portal isn't working.

Hope this helps,
Nathan