Admin locked out users from azure portal by mistake with Conditional Access

mwhitley Thanks for getting back to me. Sadly I wasn't able to get back in the way you suggested as the CA policy was setup in error and should never have been applied in the first place. It didn't have ANY grant controls in place- only block! Pleased to say that my whole ordeal is finally over!

I thought I'd just leave what my experience was like here for other admins who managed to do something similar....

I managed to accidentally enable a CA policy on a live environment before the policy had finished being setup- it definitely wasn't ready for deployment! The result was a total lockout of all users on my tenant to all services other than Exchange (including all my global admin accounts because exclusions had not yet been applied to these accounts).

It turns out you have to raise a ticket through the Azure Portal (which I was locked out of- had to use a different company's tenant to do this). They have since told me that you can use the phone numbers at the following link if locked out of the portal. At the time I couldn't find these numbers.(https://support.microsoft.com/en-us/help/4051701/global-customer-service-phone-numbers)

They escalated my support ticket all the way to the Azure Product Group (who are above the technical support team and so far as I was informed they don't work 24x7). In my case, the tool they use in the backend of the systems to let admins back in to the tenant was broken. This meant they had to have their engineers fix it before they could let me back in. (In total it took 48 hours total from initial lockout to getting back in- but this did include a Sunday as well as a Monday...).

I was told that it normally takes closer to 4 hours to be let back in after a CA lockout but I'm not sure if that's from the point the ticket is escalated to the Azure Product Group or from initial ticket submission. They clearly seemed to think that I'd been particularly unlucky with my timing of the whole thing!

In the end, the Product Group were able to use the tool to exclude my Global admin account from the offending CA policy which let me go back into the Portal and disable it.

The whole endeavour showed that the processes in place within Microsoft for resolving CA lockouts should work relatively smoothly but in my case didn't due to unavoidable circumstances on the Product Group's part.

I suggest that any other admin who has to go through this make sure that they initially report the case to the Azure Support team as O365 Support cannot even escalate a case to the Azure team. Make sure the Azure AD Support team know it has to be escalated to the Product Group. Once it has been escalated this far it's then a case of waiting for them to work their magic.

If you phone Office 365 support you will be escalated to the Data Protection team who won't be able to help you (unless you need them to reset your password to your account!).

I hope this helps other admins going through a CA lockout. When I had the misfortune of having to go through this whole thing there was very little info on forums other than mwhitley's post.

I will definitely review CA policies more carefully in future!!!