Forum Discussion

techycap's avatar
techycap
Copper Contributor
Mar 31, 2026

M365 only admin locked out MFA error 53003

I am learning this the hard way....so here it goes.

 

Currently I am locked out of as the only admin on the tenant with error 53003.

I was updating some Microsoft MFA default policy settings in Entra and mistakenly deleted the admin user from the exclusions list, and got locked out.

Thankfully I have another tenant, not as big the one locked out. Initiated several support tickets for which everyone calls, and despite of subline mentioning the issue says that they have to assign this ticket to Entra. Then the ticket gets updated and noone has been assigned every since. I have initiated severity A support tickets from Azure portal but no one has called in last 24 hours to help. We area business with Business Premium licenses with over 20 users, and now completely locked out. 

I have looked almost everywhere online. There is no phone number that takes you to a support agent - PLEASE HELP........

admin
Authentication
Entra admin center
microsoft 365
Microsoft 365 Admin app
security

3 Replies

  • Ahmed_Masoud97's avatar
    Ahmed_Masoud97
    Steel Contributor
    Sep 14, 2026

    AADSTS53003 confirms that Conditional Access is blocking token issuance.

    If no other administrator or emergency access account can sign in, there is no self-service bypass. Microsoft Support will need to recover access after verifying tenant ownership.

    Update the existing support case with the following wording:

    "Complete tenant lockout, sole Global Administrator blocked by Conditional Access, AADSTS53003, request Tenant Recovery escalation."

    Also include the affected tenant domain, request ID, correlation ID, timestamp, and business impact.

    If the Microsoft 365 licenses were purchased through a CSP or reseller, ask that partner to open or escalate the Microsoft support case on your behalf.

    After access is restored, create at least two cloud-only emergency access accounts, exclude them from Conditional Access policies, and monitor their use.

    More guidance:
    https://mstack360.com/enterprise-microsoft-365-security-implementation/

  • ClaireB's avatar
    ClaireB
    Brass Contributor
    Apr 10, 2026

    Error 53003 means a Conditional Access policy is blocking the sign-in. Since you're the only admin, this is a rough spot to be in. Try signing in from https://aka.ms/intuneeducation or directly at https://admin.microsoft.com - sometimes different portals hit different CA policies. If that doesn't work, you might need to contact Microsoft support. For the future, always have a break-glass account that's excluded from all CA policies.