Conditional Access Problems

How to Recover a Locked Global Admin Account After Conditional Access Changes

Maira Mehtab Oct 12, 2026 868 views

Question details

The user needs to recover access to a Global Administrator account that was locked out due to a newly implemented Conditional Access policy enforcing strong authentication.

Recover a Locked Global Administrator Account After Conditional Access Changes

Product: Microsoft Entra ID
Device & OS: not provided
Scenario: A Conditional Access policy was modified to require authentication methods the administrator cannot provide or has not registered from their current environment.
Observed behavior: The Global Administrator account is completely locked out, preventing backend access, policy management, and administrative identity verification.

Before you start

Check if your organization has an active 'break-glass' (emergency access) Global Administrator account configured, as using a secondary excluded account is the fastest way to regain tenant control.

Solution 1Recommended

Use an Emergency Global Administrator Account

Log in with a backup 'break-glass' administrative account to temporarily exclude the locked account from the problematic Conditional Access policy.

If you have an emergency access account configured, you can use it to regain control of your tenant and adjust the policy that caused the lockout without waiting for Microsoft support.

Log in to Entra ID

Access the Microsoft Entra admin center using your secondary or emergency Global Administrator account.

Navigate to Conditional Access

Go to Protection > Conditional Access > Policies from the left-hand navigation menu.

Exclude the locked account

Select the policy causing the block. Under the Assignments section, click 'Users', add your locked-out account to the 'Exclude' tab, and save your changes.

Use an Emergency Global Administrator Account

Best Practice: Always maintain at least two emergency access accounts in your tenant that are permanently excluded from standard Conditional Access policies to prevent total lockouts.

Solution 2

Escalate to Microsoft Data Protection Team

If no other Global Administrator accounts are available to modify the policy, you must contact Microsoft Support to initiate tenant recovery.

Free Microsoft Office alternative

Document Your IT Recovery Plans with WPS Office

While resolving administrative lockouts in Microsoft 365, you may need a reliable suite to manage incident reports and emergency documentation. WPS Office offers a lightweight, free alternative that ensures you can continue working without Microsoft Office access.

1. Download the software: Visit the official WPS Office website and click the free download button.
2. Install WPS Office: Run the installer file and follow the standard on-screen installation prompts.
3. Create your documentation: Open WPS Writer or Spreadsheet to begin drafting your incident reports and recovery procedures.

100% compatible with Microsoft Word, Excel, and PowerPoint files (.docx, .xlsx, .pptx).Free, lightweight, and fast to install on any device during emergencies.Familiar user interface ensuring immediate productivity and zero learning curve.Ideal for maintaining offline access to critical IT disaster recovery documents.

microsoft office alternative - wps office

Frequently Asked Questions

Why does a Conditional Access policy lock out the Global Admin?

This happens when a policy enforces strong authentication (such as MFA or requiring a compliant device) that the administrator account hasn't registered for or cannot fulfill from their current network environment.

How long does it take for Microsoft to recover a locked tenant?

Escalations to the Microsoft Data Protection Team typically take 2 to 3 weeks. The team must perform rigorous backend security checks to verify your identity before safely bypassing your tenant's security rules.

What is a break-glass account in Microsoft 365?

A break-glass or emergency access account is a highly privileged Global Administrator account deliberately excluded from Conditional Access policies. It acts as a safety net to prevent total tenant lockouts.

Can I bypass the Conditional Access policy using PowerShell?

No. If your administrative account is blocked by Conditional Access, the same authentication requirements apply to PowerShell connections. You must either use an excluded emergency account or contact Microsoft support.

Microsoft Office Security Issues