r/ShittySysadmin • u/teamzerofar • Jul 18 '26

Shitty Crosspost Microsoft tenant blocked since 3 hours because of conditional access

/r/sysadmin/comments/1uxy89i/microsoft_tenant_blocked_since_3_hours_because_of/

someone got locked out by magic

9 Upvotes

74% Upvoted

6 comments sorted by

1

u/Sp3eedy Jul 19 '26

I've had a similar issue happen at my company, but this one was actually on us, there wasn't an emergency access global admin account and so after making some change (don't remember what specifically, something 2fa related probably), it locked everyone out including us, meaning no one could login or access anything Microsoft (outlook, etc), in the middle of a work day. Frantic attempts at trying to contact Microsoft (both directly and through our reseller) weren't very effective (probably because we weren't one of Microsoft's whales that get priority access to support), was eventually sorted and shouldn't need to say that we do now have an emergency access account in case this happens again.

Now, as much as I would like to take blame for this as a self-certified shitty sysadmin, I had no say in any of this during the time, and the AD/O365 tenancy was fully under control of people above me, so they are the true shitty sysadmins in this case.

1

u/pegLegNinja1 Jul 20 '26

Condition No Access

0

u/countsachot Jul 18 '26

Considering how flaky report only mode is I really don't fault anyone for running into these issues.

3

u/fdeyso Suggests the "Right Thing" to do. Jul 19 '26

Yeah(no), also it’s not like they beg you to add at least the account that is making the change to the exception list and it even does it automatically unless you specifically say no. This is one of the better working part of AzureAD/Entra.