Locked out of my Azure subscription after an Entra change — AADSTS16000 / Microsoft Services tenant

David Gomes 0 Reputation points
2026-09-07T22:08:27.83+00:00

Hello Microsoft Azure Support / Moderators,

I am the sole administrator of an Azure subscription that I created through Microsoft for Startups, and I am now completely locked out of Azure.

My Azure subscription was successfully created before this issue occurred:

Subscription name: Azure subscription 1 Subscription ID: 5733191a-0691-4393-9b61-1f5e354fd9e2

I originally signed up using a personal Microsoft account (live.com).

Immediately after making a change in Microsoft Entra, I lost access to Azure. Since then, when I try to access Azure, I receive the following error:

AADSTS16000: User account from identity provider 'live.com' does not exist in tenant 'Microsoft Services' and cannot access the application ... in that tenant. The account needs to be added as an external user in the tenant first.

The tenant shown in the error is:

Microsoft Services Tenant ID: f8cdef31-a31e-4b4a-93e4-5f571e91255a

I understand that this may be the default Microsoft Services tenant associated with personal Microsoft accounts, but I cannot determine whether this is the tenant associated with my Azure subscription because I am completely unable to access the Azure portal and verify my directory/tenant information.

The problem also prevents me from contacting Azure Support. When I open Help + Support, the Support Portal itself fails to retrieve an access token and returns another authentication error involving Microsoft_Azure_SupportPortalExtension / AADSTS16000.

Therefore I cannot create a normal Azure support request from the affected account.

The important point is that I already have an existing Azure subscription. I am not trying to create a new Azure subscription or a new tenant. I need to recover access to the existing subscription and determine/recover the Entra tenant associated with it.

I am the sole administrator, so there is no other administrator who can sign in and restore my access.

The lockout occurred immediately after I made a change in Microsoft Entra.

Could a Microsoft moderator please help escalate this to the appropriate Azure tenant/account recovery or Data Protection team, or provide a private channel through which I can verify ownership of the subscription and account?

I can provide the Trace ID, Correlation ID, timestamps, account verification, and other proof of ownership privately if required.

Thank you.

Azure Role-based access control
Azure Role-based access control

An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Rukshan edirisinghe 165 Reputation points
    2026-09-08T03:11:57.37+00:00

    Hi @David Gomes

    You've read the error correctly, and the good news is your subscription is not gone. The Microsoft Services tenant (f8cdef31...) is the shared default tenant that personal accounts land in when the portal can't find any directory where the account is currently a member. So the error tells us your live.com account is no longer resolving as a member of the tenant that holds your subscription. The subscription itself still exists in its original tenant and your resources keep running, what broke is your account's membership, which lines up exactly with the Entra change you made right before. The usual culprits are deleting a user object that was actually your admin identity, or leaving the organization.

    Two quick checks before any escalation, neither needs the Azure portal:

    1. Sign in at https://myaccount.microsoft.com and open the Organizations page. It lists every tenant your account is still a member of. If your tenant appears there, membership is intact and this is only a routing problem: open https://portal.azure.com/yourtenant.onmicrosoft.com in an InPrivate window (the tenant domain or ID is in your Microsoft for Startups welcome email or on any old invoice PDF).
    2. If the Organizations list doesn't show your tenant, membership is genuinely gone, and since you were the sole admin there is no self-service recovery for this state. It requires Microsoft's Data Protection / Tenant Recovery team.

    For that escalation you have three parallel routes:

    1. You asked the right thing in your post. Microsoft moderators on Q&A do forward sole-admin lockouts to the Data Protection team and will request the sensitive details via private message, so keep your Trace ID, Correlation ID, timestamps and proof of ownership ready, and don't post anything more publicly.
    2. Call the regional number from the global customer service phone numbers page and ask explicitly for a service request routed to the Data Protection / Tenant Recovery team for a tenant lockout where the sole Global Administrator lost access. Ownership verification (billing details, domain/DNS if you have a custom domain) is part of their process.
    3. If phone routing goes nowhere, create a ticket from a different account or a fresh free tenant, and state explicitly that the request concerns a different, existing tenant whose only admin is locked out. Include the locked tenant's onmicrosoft.com domain or tenant ID, your subscription ID and your account UPN.

    One time-sensitive note: if the change you made deleted a user object, deleted Entra users sit in a 30 day soft-delete window during which support can restore them, so move on this promptly rather than waiting on one channel.

    Once you're back in, immediately add a second Global Administrator or a dedicated emergency access account so a single account change can never orphan the tenant again.

    References: https://support.microsoft.com/en-us/topic/global-customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2 https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-accessHi @David Gomes,

    You've read the error correctly, and the good news is your subscription is not gone. The Microsoft Services tenant (f8cdef31...) is the shared default tenant that personal accounts land in when the portal can't find any directory where the account is currently a member. So the error tells us your live.com account is no longer resolving as a member of the tenant that holds your subscription. The subscription itself still exists in its original tenant and your resources keep running, what broke is your account's membership, which lines up exactly with the Entra change you made right before. The usual culprits are deleting a user object that was actually your admin identity, or leaving the organization.

    Two quick checks before any escalation, neither needs the Azure portal:

    1. Sign in at https://myaccount.microsoft.com and open the Organizations page. It lists every tenant your account is still a member of. If your tenant appears there, membership is intact and this is only a routing problem: open https://portal.azure.com/yourtenant.onmicrosoft.com in an InPrivate window (the tenant domain or ID is in your Microsoft for Startups welcome email or on any old invoice PDF).
    2. If the Organizations list doesn't show your tenant, membership is genuinely gone, and since you were the sole admin there is no self-service recovery for this state. It requires Microsoft's Data Protection / Tenant Recovery team.

    For that escalation you have three parallel routes:

    1. You asked the right thing in your post. Microsoft moderators on Q&A do forward sole-admin lockouts to the Data Protection team and will request the sensitive details via private message, so keep your Trace ID, Correlation ID, timestamps and proof of ownership ready, and don't post anything more publicly.
    2. Call the regional number from the global customer service phone numbers page and ask explicitly for a service request routed to the Data Protection / Tenant Recovery team for a tenant lockout where the sole Global Administrator lost access. Ownership verification (billing details, domain/DNS if you have a custom domain) is part of their process.
    3. If phone routing goes nowhere, create a ticket from a different account or a fresh free tenant, and state explicitly that the request concerns a different, existing tenant whose only admin is locked out. Include the locked tenant's onmicrosoft.com domain or tenant ID, your subscription ID and your account UPN.

    One time-sensitive note: if the change you made deleted a user object, deleted Entra users sit in a 30 day soft-delete window during which support can restore them, so move on this promptly rather than waiting on one channel.

    Once you're back in, immediately add a second Global Administrator or a dedicated emergency access account so a single account change can never orphan the tenant again.

    References:
    https://support.microsoft.com/en-us/topic/global-customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2
    https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.