The support channels are failing miserably
I own a company and registered for a work account 2 years ago. We haven't purchased any Microsoft products yet, and I got logged out of authenticator. We're in a vicious cycle where logging in requires authenticator and authenticator requires authenticator. I called technical support Monday and was told to sign up for new account to log a ticket. Mid-way through the call the agent said his shift ended in 2 minutes and he would call me back Tuesday. He never called back. I followed up and waited on hold for the data and privacy department for 45 minutes 3 times, and each time the call dropped. I tried using the support agent and it won't help me, because it says I'm not the global admin on any of my accounts (this makes no sense). Are there any channels for escalating this? We would like to buy Microsoft 365 for our business, but now I am terrified of doing this, because it seems like there is no way to get technical support.Microsoft Launches Preview for Entra ID Conditional Access Policy Plans
Conditional access policy plans are now available in preview. The idea is to define common rules, conditions like breakglass accounts and have the details inherited by CA policies. Microsoft provides a migration facility to move existing policies to plans, but it’s probably going to take some time for tenants to inventory their current CA policies, understand points of commonality, and slowing move towards rationalization. https://office365itpros.com/2026/10/29/conditional-access-policy-plans/
Passkey/FIDO2 for users in mainland China – recommended approach?
Hi, We are currently evaluating the adoption of Passkey/FIDO2 in Microsoft Entra ID as part of our strategy to move users away from traditional authentication methods such as SMS and voice and towards phishing-resistant authentication. Our Microsoft Entra ID tenant is a global tenant (not Azure China operated by 21Vianet), but we have a group of users who are physically located in mainland China. For users in other regions, we are evaluating Passkeys in Microsoft Authenticator and FIDO2 security keys. However, before defining the approach for our users in China, we would like to better understand the supported and recommended architecture for this particular scenario. We have reviewed the Microsoft documentation and understand that: Passkeys are not available for Microsoft Azure operated by 21Vianet. On iOS, Microsoft Authenticator Passkeys can be used to sign in to global organizations while the user is in China. On Android, Passkey authentication has dependencies such as Google Play Services, which raises questions for devices operating in mainland China. Our main questions are: For users physically located in mainland China but authenticating against a global Microsoft Entra ID tenant, what is Microsoft's recommended approach for deploying phishing-resistant authentication with Passkey/FIDO2? Is Microsoft Authenticator Passkey on iOS considered a fully supported option for users permanently located in mainland China, rather than only users temporarily traveling there? For Android users in mainland China, what is the recommended approach considering the dependency on Google Play Services? Is Passkey in Microsoft Authenticator a realistic supported option in this scenario? Would physical FIDO2 security keys be the preferred or more consistent alternative for users in China when mobile Passkeys cannot be reliably used? Are there any other Microsoft-supported Passkey providers or authentication approaches that should be considered specifically for mainland China? From an enrollment perspective, what would be the recommended bootstrap process for these users? For example, would Temporary Access Pass (TAP) be the recommended method to allow users to register their Passkey/FIDO2 credential before SMS/Voice is removed? Are there any additional regional, connectivity, mobile OS, or application compatibility considerations that should be taken into account before enforcing a phishing-resistant Authentication Strength through Conditional Access? Our objective is not simply to enable Passkey in the tenant, but to define a supported and sustainable authentication model for users located in mainland China before starting a broader rollout. Any experience, Microsoft guidance, or recommended architecture for this type of scenario would be greatly appreciated. Thanks in advance.
Lost trying to activate Office Professional 2021 on machine Frankensteined from an old one
We had a terrible old PC that was running Office Pro 21 with valid key.~ I was given an nicer PC which was effectively a shell with two blank drives and a better spec. I placed the C from the old PC into a newer build and did a fresh Windows install and the Old C became a slave drive but was not wiped. I thought I would be able to install Windows Pro again on the new drive as it was a valid code but it seems not. Perhaps it's for one device only. The Old C became the E and is still accessible but I can't use and access the Office Suite and activation states that the code has already been used or is invalid. I don't know how to approach this. The original code was valid, can the code only be used on one device? I'm not sure how to resolve this. I would really appreciate some advice about how to approach this as the website doesn't really provide the answer. Please do ask if you have require any more info and thanks in advance for any help.
Trying to get support in reseting Authenticator MFA
Hello! We are locked out of our tenant's admin center as our authenticator installed device has been reset by mistake. I contacted our call MS service phone number (211 18 13 880) in Greece, but the AI bot is unable to record the case as it cannot vocally identify the admin user account and domain of our tenant, finally it terminates the call. There is no direct contact email or phone to human support from the data protection team. How are we supposed to handle this case further? .
Entra ID 53003: How to identify primary authentication when Authentication Details are empty?
We are investigating repeated interactive Microsoft Entra ID sign-ins with the following pattern: - ErrorCode: 53003 (BlockedByConditionalAccess) - isInteractive: true - AppDisplayName: OfficeHome - Authentication requirement: Multifactor authentication Conditional Access correctly blocks these requests because they originate outside our trusted locations. We have already confirmed through controlled testing that the authentication flow can reach 53003 after the correct credentials are provided. Our current problem is different: We need to determine what mechanism satisfied the primary/first authentication factor for the observed 53003 events. For these events, Authentication Details are empty: - Authentication method: empty - Authentication method detail: empty - Result detail: empty Therefore, we cannot determine whether primary authentication was performed using a password, an existing token/session claim, PHS, PTA, federation, Seamless SSO, or another mechanism. Our questions are: 1. Is there any tenant-visible telemetry that can identify the primary authentication mechanism when AuthenticationDetails is empty? 2. Can fields such as AuthenticationProcessingDetails, AuthenticationProtocol, IncomingTokenType, OriginalTransferMethod, or AuthenticationMethodsUsed reliably distinguish between password validation and reuse of an existing authentication/token? 3. If additional authentication infrastructure is used: - can PTA Authentication Agent logs be correlated using RequestId or CorrelationId? - should Seamless SSO generate a corresponding Kerberos 4769 event for AZUREADSSOACC$? - should federated authentication be traceable in AD FS logs? 4. For Password Hash Synchronization, is there any tenant-visible telemetry confirming that Entra ID actually validated the password for a specific sign-in request? 5. If this information is not exposed to the tenant, can Microsoft Support retrieve backend authentication telemetry for a specific Sign-in ID / RequestId / CorrelationId and determine how primary authentication was satisfied? Our goal is not to determine why Conditional Access generated 53003 — that part is already understood. We specifically need to identify what satisfied primary authentication before the Conditional Access evaluation.
Free, offline tool: see each user's real passkey policy in Entra ID and who SMS retirement blocks
Entra combines passkey profiles as a union (any profile that allows a passkey type wins), while Conditional Access works as an intersection. So a Global Admin in a strict "security keys only" profile who is also in an All Users profile can still register a synced iCloud or Google passkey, and the portal never shows you that per user. I built EffectivePasskey to answer three questions for every user and admin: 1. What passkey can this person actually register? 2. What can this admin actually sign in with after Conditional Access? 3. Who gets blocked when SMS and voice MFA retire (1 Feb 2027, and 1 Jul 2027 for Global Admins)? It runs entirely on your machine from read-only JSON exports. It never signs in to your tenant and never changes anything. No telemetry. MIT licensed and completely free. Try it with the included demo tenants: pip install effective-passkey GitHub: https://github.com/xsignon-secure/EffectivePasskey Feedback and issues are very welcome, especially from anyone mid-rollout.
No acces to local Office365 apps with an account which differs from the current windows account
Hi, guys! I'm working with Windows 11 Pro using the Microsoft account ABC. Today I bought a Office 365 Family License - by using another Microsoft account XYZ. I downloaded the local apps successfully... ...but when I start the local app and tried to sign in using the XYZ account, I'm asked for the Windows Hello Pin for the XYZ account - but there is no PIN for that, because the account doesn't exist as a Windows account at this computer at all. Copilot says: "You can sign in to Windows 11 with one Microsoft account and use a different Microsoft 365/Office account for Office applications. Microsoft supports this setup." What did I wrong - what can I do? Kind regards! SebastianHacked Microsoft Account Recovery with Semi Access
I'm at a complete loss and it is infuriatingly ridiculous. I am entirely unable to get a hold of a human being at Microsoft and am being turned down by automated responses nonstop. So here's what's happening: My Microsoft account has been hijacked (obviously not this one) for its valuable Minecraft account and has now been sold. I am logged into my account via my PC, have full access of the main email address, but I have been locked out of my account using the alias email. Whenever I want to log in to my account, it wants to instead send a code to an email address I do not own and can't access. I have tried the Sign-In Helper, the Recovery Form, the hotline, the support email without any result, let alone a non-automated response. I sadly don't have the Recovery Code of my 15 year old-ish account. Since I still have full access of my email address I get updates of security info being changed and what not. Last month a stranger sent me screenshots of someone trying to sell my Minecraft account, for which I myself have received multiple buying offers, and voila yesterday I received notification of my alias mail address changing followed by Minecraft server apps being added to my Microsoft account. While I had already given up retrieving my account, whenever I get notifications my heart sinks a new while some hope sparks up again. Do you people have any idea of what I could do? I don't even rule out legal actions at this point. While I do of course have the email address of the hijacker and the buyer, I fear that contacting them results in me being locked out permanently. I'm just begging to catch the attention of anyone involved with Microsoft. This being walled out with automated responses is killing me.Sketchy behaviour from Microsoft on MFA - what gives?
Recently, Microsoft has overwritten our Authentication Method Registration campaign settings, from 'Disabled' to 'Microsoft Managed' for dozens of tenants. Thanks guys. That's not super sketchy at all. /s This was ostensibly done for the Retiring of Voice and SMS based MFA or, as the article puts it 'To help enterprises adopt AI at scale,'.... what? Not because they're garbage MFA methods? But so Microsoft can market-capture MFA? Regardless of that bizarre statement, this article is sub par - like most Microsoft 'help' docs, it appears to have been written by someone in Marketing, with no technical experience. My chief concern is that the term 'OTP' doesn't appear ANYWHERE in here. So, for us and our customers - who block Voice/SMS already - this is alarming. Microsoft's Passkey flow is confusing af to people - and since it includes SYNCED passkeys by default, it faces the same risks as OTP. We specifically HAVEN'T rolled out passkeys because everytime we do, people get confused and frustrated - because they'll have 3-4 different things pop-up, offering to take a sync'd passkey. Really concerned with my 'do not allow microsoft to manage' setting, being explicitly set to 'Microsoft managed', and whatever decisions they're NOT publicly addressing at this point. We've spent years teaching people to use Microsoft Authenticator and password vault-based OTP. Now, Microsoft is pushing everyone to keep using those same tools, but to go through the mess that is the passkey setup interface?
