Critical: admins locked out by a Conditional Access policy, and how to recover

#Symptoms

• Admins get AADSTS53003 ("Access has been blocked by Conditional Access policies") or MFA/device compliance loops on every admin portal.
• Often follows a new policy like "Require compliant device for all users, all apps" or "Block legacy locations" without exclusions.

#1. Use a break-glass account

Emergency access accounts should:

• Be cloud-only (breakglass1@contoso.onmicrosoft.com), Global Administrator, permanently assigned.
• Be excluded from all Conditional Access policies.
• Use phishing-resistant MFA (FIDO2 key stored in a safe) — Microsoft now enforces MFA for admin portals, so a password alone won't work.

Sign in at https://entra.microsoft.com with the break-glass account, then:

Protection → Conditional Access → Policies → open the offending policy → set it to Off (or Report-only) → Save.

Changes apply on new sign-ins within minutes.

#2. With PowerShell / Graph (if the portal loads slowly)

Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess","Policy.Read.All"
Get-MgIdentityConditionalAccessPolicy | Select-Object Id, DisplayName, State, CreatedDateTime |
  Sort-Object CreatedDateTime -Descending | Select-Object -First 5
Update-MgIdentityConditionalAccessPolicy -ConditionalAccessPolicyId "<policy-id>" -State "disabled"

#3. Find what changed

• Entra ID → Audit logs, category Policy, activity "Update conditional access policy" / "Add conditional access policy": who, when, what.
• Sign-in logs of a blocked admin → Conditional Access tab shows which policy failed and why.

#4. If no break-glass account works

• Check whether any admin can still sign in: a role holder on a compliant device, from a trusted location, or someone excluded via a group.
• Otherwise open a Microsoft support case (from another tenant or by phone). Microsoft has a tenant recovery process, but it requires proof of ownership and takes time (days, not minutes). This is why break-glass accounts matter.

#5. Fix the policy, then re-enable safely

1. Add exclusions: break-glass accounts (always), and a pilot scope.
2. Turn it on in Report-only first; review the Report-only results in sign-in logs or the CA insights workbook for a few days.
3. Use the What If tool for admin accounts before enabling.
4. Enable for a pilot group, then everyone.

#6. Controls

• Two break-glass accounts, tested quarterly (sign-in test + alert test).
• Alert on any break-glass sign-in (Log Analytics alert on SigninLogs where UserPrincipalName matches).
• CA changes through change management, ideally as code (Microsoft Graph / Terraform azuread_conditional_access_policy) with review.

SigninLogs
| where UserPrincipalName startswith "breakglass"
| project TimeGenerated, UserPrincipalName, IPAddress, ResultType, AppDisplayName

Warning

Never exclude break-glass accounts only through a group that admins can edit freely, and never let them expire with PIM. A lockout is exactly when you can't fix those things.