Forum Discussion
Recovering our Default Azure Directory
Hello, everyone, relative newcomer to Azure here. I'm dealing with an inherited situation and, to add to the fun, I've just discovered my organization only has a Basic support plan, so no access to Azure technical support. I'm hoping some knowledgeable souls on here are in a charitable mood and will point me in the right direction.
We're having problems getting to our DNS subscription because it's locked away behind an Azure directory to which we don't seem to have access, and I'm not quite sure this is completely an Azure problem. I was able to get into this directory around a year ago but I so seldomly access it that I'm not sure when this changed.
We have two Azure directories. One is our "regular" directory, named for our organization, and it's linked (not sure of the terminology here) to our domain. Let's call it This.Domain.com. There are no subscriptions in this directory.
The other is named "Default Directory" and it's linked to an onmicrosoft domain -- let's call it OldAdminThisDomain.onmicrosoft.com. When I try to switch to this directory I'm prompted to log in, then I'm hit with the MFA prompt. This is normally not a problem but it's like the MFA was set up for a different account with the same email address. By contrast, I can log into both the regular Azure directory and the 365 admin page with no problem -- I type in my email address (let's call it email address removed for privacy reasons), MFA comes up, and I have several authentication methods to choose from: Microsoft's MFA app, SMS, email, YubiKey, phone, etc., and all these options work.
When trying to log into the Azure Default Directory, however, the MFA acknowledges only either the Microsoft Authenticator app or Use a Verification Code (which also goes through the Microsoft Authenticator app), and neither option yields any prompt on my phone. I seem to recall I effectively had two different "accounts" that somehow used the same email address but had different MFA setups, but again this was around a year and 3 phones ago so I don't have a solid memory of what was happening. I am also aware that, while this should not be permittable, there have been several cases where multiple Microsoft accounts were somehow created using the same email address.
So this is where I am. Ideally we could merge the two Azure directories so that we combine the accessibility of the "regular" directory with the subscription(s?) that are in the Default Directory. Barring that I would have to somehow get the (suspected) two Microsoft accounts based on the email address removed for privacy reasons email address corrected. Any help would be greatly appreciated.
Thanks to all in advance
2 Replies
I would treat this as an identity/tenant recovery issue first, not only as a DNS subscription issue.
The safest approach is:
1. Identify the tenant ID that owns the DNS subscription. You may be able to find it from old invoices, Azure emails, subscription exports, deployment records, or any user who previously accessed it.
2. Check whether any current user in your organization still exists in that tenant and has Global Administrator, Privileged Role Administrator, or at least subscription Owner access.
3. If the tenant uses a custom domain that your organization owns, verify who controls DNS for that domain. That can matter for proving ownership, but do not remove or re-add domains without understanding impact.
4. If no admin exists or you cannot access the tenant, open a Microsoft support case for tenant/subscription ownership recovery. Even with a Basic plan, billing/subscription/account access issues usually have support paths separate from paid technical support.
5. Avoid deleting directories, moving domains, or changing DNS zones until support confirms the recovery path, because those actions can make ownership proof harder.
For the DNS workload itself, once access is restored, I would document the tenant ID, subscription ID, break-glass accounts, billing owner, and emergency access process so this does not happen again.
Docs:
https://learn.microsoft.com/entra/fundamentals/users-restore
https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access
I believed not, it cannot merge two Azure Active Directories (tenants), while subscriptions are tied to a single directory. To recover access to your “Default Directory” and its subscription, you must regain sign-in capability to that tenant, then transfer or reassign the subscription if needed.
https://learn.microsoft.com/en-us/entra/fundamentals/how-subscriptions-associated-directory
https://learn.microsoft.com/en-us/azure/azure-portal/set-preferences
