'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Remove Microsoft 365 SAML Federation When Sign-In Is Blocked
Question details
Administrator needs to recover access to a Microsoft 365 tenant after a misconfigured Google Workspace SAML federation redirects and blocks all admin sign-ins.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- The administrator set up SAML SSO federation with Google Workspace, but the configuration broke the tenant, redirecting every sign-in attempt and preventing access to the admin portal.
- Observed behavior
- Administrators cannot sign in to Microsoft 365, remove the SSO configuration, change the domain, or create a support ticket because the sign-in redirect loops or fails continuously.
Gather your tenant domain information, federation configuration details, error logs, and official proof of domain ownership before contacting support.
Contact Microsoft Support and Escalate to the Data Protection Team
Since self-service is impossible when you are completely locked out by a broken SAML federation, you must contact Microsoft Support by phone to resolve this tenant-level lockout.
When all administrator accounts are redirected to an unavailable or misconfigured identity provider (like Google Workspace), self-service recovery is not possible. First-line support agents usually cannot bypass tenant-level federation settings.
The only way to forcefully remove the broken SAML federation is to have Microsoft's Data Protection team intervene and disable SSO from the backend.
Look up the official Microsoft business support phone number specific to your country or region.
Call the support line and explicitly state that you are experiencing a complete tenant lockout due to a broken SAML federation setup.
Ask the support agent to immediately escalate your case to the Microsoft Data Protection team, as first-line support cannot remove backend federation bindings.
Provide the requested verification details, including your tenant domain (e.g., yourcompany.onmicrosoft.com), exact error messages, and proof of ownership.
Wait for the Data Protection team to contact you to manually sever the SAML connection, which will eventually restore standard password sign-in for global administrators.
Keep Your Business Running with WPS Office While Locked Out
While waiting for Microsoft 365 access to be restored, you don't have to halt your business operations. WPS Office provides a lightweight, free alternative that lets your team work locally without relying on cloud federation.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install WPS Office: Run the installer and follow the on-screen prompts to complete the setup in just a few minutes.
- 3. Open and Edit Microsoft Files: Double-click any existing Word, Excel, or PowerPoint document to open it seamlessly in WPS Office and continue working offline.
Frequently Asked Questions
Can I bypass the SAML federation redirect using an onmicrosoft.com account?
If your global admin account uses the default onmicrosoft.com fallback domain rather than the federated custom domain, you might be able to bypass the SSO redirect. Go to the sign-in page and enter admin@yourdomain.onmicrosoft.com to check if you can authenticate directly.
Why did Google Workspace SAML federation break my Microsoft 365 sign-in?
This usually happens if the Identity Provider (IdP) settings are incorrect, the certificate is invalid, or the immutable ID mapping between Microsoft 365 and Google Workspace fails. Consequently, Microsoft delegates authentication to Google, but Google rejects or incorrectly routes the request.
How long does the Microsoft Data Protection team take to resolve a tenant lockout?
Depending on current support volumes and the complexity of verifying your identity and domain ownership, it can take anywhere from a few days to several weeks. Ensure you provide accurate proof of ownership immediately to avoid unnecessary delays.
