Azure portal access

Question

Azure portal access

Aprille Ostert 0

I created a new Azure subscription this weekend.

My account is ******@ostertpt.com.

Azure CLI authenticates successfully.

I am the Owner of the subscription.

Azure CLI has already created my resource group, virtual network, subnets, private DNS zone, PostgreSQL Flexible Server, and database.

However:

Azure Portal says "You don't have access."
My account appears as an #EXT# guest identity.
I cannot submit an App Service quota increase request.
My Microsoft.Web Total VMs quota is 0 in East US 2.

I need help restoring Azure Portal access or having the App Service quota increased from 0 to 1.

0 comments

1 answer

Your answer

Answer 1

Nathan Roberts (SN) 13,111 Student Ambassador Volunteer Moderator

Hey there, Aprille Ostert

My account is ******@ostertpt.com.

This account is a work account, which you have used to sign-up for an Azure subscription. Please can you answer the following questions:

Are you the owner of the tenant?
Are there any other admins for the tenant?

It sounds as though someone has converted your account to guest, and restricted your access to the Azure portal. If there are other admins who control the tenant, you would need to speak to them and ask them to allow you access and convert your account to a member, rather then a guest account.

Hope this helps,
Nathan

Aprille Ostert 0 Reputation points

2026-08-02T21:15:14.08+00:00

Hi Nathan,

Thank you.

We created our Microsoft 365 environment using our `ostertpt.com` domain, and I created the Azure subscription this weekend using `******@ostertpt.com`.

I am not sure who is currently the Microsoft Entra Global Administrator, so I don't want to assume my account was intentionally converted to Guest.

Is there a way to confirm whether my account is currently a Guest or Member, and identify who the Global Administrator is for this tenant?

That would help us determine the correct next step.
Nathan Roberts (SN) 13,111 Reputation points Student Ambassador Volunteer Moderator

2026-08-04T16:51:28.08+00:00

Hey there, Aprille Ostert

I am not sure who is currently the Microsoft Entra Global Administrator, so I don't want to assume my account was intentionally converted to Guest.

This doesn't have to be done intentionally. I have come across people who have accidently converted an account to a guest when browsing the Microsoft Entra ID portal.

The global administrator may be the person who set up your Microsoft 365 subscription for your org?

My account appears as an #EXT# guest identity.

Because this is a work account, that suddenly has the EXT applied to the username suggests it is a guest inside the tenant. Either that, it has been changed. Does it still show your domain at the end?Thanks,
Nathan
Aprille Ostert 0 Reputation points

2026-08-04T18:51:09.89+00:00
Hi Nathan,

Thank you for the reply.

I gathered some additional information over the weekend using Azure CLI.

The account is:

Azure Subscription Owner

The only Microsoft Entra Global Administrator in the tenant

Reported by Microsoft Graph as userType = Member

However, the UPN is:

abostert_ostertpt.com#EXT#@abostertostertpt.onmicrosoft.com

The Azure CLI authenticates successfully, but Azure Portal and Entra Admin Center fail with AADSTS530035 before the portal loads.

Does this combination (Member + Global Administrator + #EXT# UPN) suggest the account originated as an external identity and should be converted to a native tenant account, or is there another supported explanation?

Thanks again for your help.
Nathan Roberts (SN) 13,111 Reputation points Student Ambassador Volunteer Moderator

2026-08-05T10:51:18.78+00:00
Hey there, Aprille Ostert

Thanks for the update.

As you have used Azure's CLI and it has authenticated successfully so you can use it, but are unable to sign into the Azure portal with an ADSTS error may suggest where the problem is originating from.

The Azure CLI authenticates successfully, but Azure Portal and Entra Admin Center fail with AADSTS530035 before the portal loads.

This error means the sign-in is being blocked by a security policy or conditional access before the portal is able to load. This could be because:

The account you are using doesn't have multi-factor authentication (MFA) configured?

Has been identified as a risky sign-in,

Has a legacy sign-in that has been detected,

You can read more on this error here: https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes#:~:text=Conditional%20Access.-,AADSTS530035,-BlockedBySecurityDefaults%20%2D%20Access%20has

Microsoft has been rolling out an update regarding admin accounts and the need for them to have MFA enabled on their accounts in order to access admin portals. You can find out more about this change here: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication?tabs=dotnet

Please can you answer the following:

Did you set-up MFA on your Microsoft account?

Are you able to sign into the Microsoft Entra ID portal here: https://entra.microsoft.com/#home

I am hoping you are able to sign into the Microsoft Entra ID portal, as we can look at setting up a temporary admin profile for the tenant (just in case your account gets locked out) and set-up MFA on your admin account to see if this allows you to sign back into Azure successfully.

Thanks,
Nathan