How do I fix a tenant access blocked error?

Hi Jennifer Comer,

Good day, and thank you for detailing your issue so clearly.

The error you're seeing - TenantAccessBlockedException - typically appears when a Microsoft 365 tenant has been blocked at the organization level. This can happen if:

• Your Microsoft 365 subscription was temporarily suspended due to an expired domain, billing issue, or past‑due balance, or
• You recently renewed your domain, but the update hasn’t fully propagated through Microsoft’s backend systems yet (this can take up to 24 hours).

Because this is an organization‑level block, it must be addressed by your Microsoft 365 Global Admin role (IT admin); individual users cannot resolve it by reinstalling apps, clearing cache, or changing local settings.

To proceed, please have your Global Administrator complete the following steps:

1. Verify and resolve any billing‑related issues

• Sign in to the Microsoft 365 Admin Center.
• Navigate to Billing > Bills & payments and settle any overdue balance.
• Then go to Billing > Your products, select the Microsoft 365 or Exchange Online subscription, and check the status.
  • If the subscription shows Suspended or Disabled, select Reactivate subscription and follow the prompts (including updating the payment method if needed).

If you’ve confirmed your billing is up to date, you can skip Step 1 and continue with the remaining steps.

2. Check for compliance‑related holds

• Review the Microsoft 365 Compliance portal to ensure there are no compliance blocks or enforcement actions impacting tenant availability.

Note: After clearing overdue balances or reactivating a subscription, Microsoft may take 1–3 hours (up to 24 hours) to fully restore services. During this time, you may still see the error: “Tenant is blocked with Microsoft.Exchange.Data.Storage.TenantAccessBlockedException.

3. Use PowerShell to verify and unblock accounts

Your Global Admin can run the following commands: Verify if your SKU (license) is Active:

Connect-MsolService

Get-MsolAccountSku

• Run:
• Set-MsolUser -UserPrincipalName ******@domain.com -BlockCredential $false
• This unblocks the user (if individual account was locked).

If a suspension/block is confirmed but cannot be resolved via the admin portal, your Global admin should submit a ticket with Microsoft support.  

A technical support engineer can initiate a remote session to review the issue in detail, confirm the backend configurations, and run any required synchronization tools to help resolve the problem. If additional expertise is needed, they can involve the appropriate specialized team for deeper investigation.

Here’s what your Microsoft 365 Global Admin (IT Admin) should do next:    

• Your Global Admin should open a support ticket with Microsoft to receive advanced diagnostics and technical assistance. Detailed instructions are available here: Get support - Microsoft 365 admin.      
• If phone assistance is preferred, your admin can use the following link to find the correct contact number: Global Customer Service phone numbers - Microsoft Support   
• If your subscription is managed through a Microsoft partner or reseller, they can also assist with opening a support request and liaising with Microsoft on your behalf.   

Note: If you are not the Global Administrator, please work with your Microsoft 365 Global Admin to complete these steps, as only they have the required permissions.

I apologize for redirecting you the related team support, as the moderators in this community don’t have access to the detailed system needed to troubleshoot this effectively due to privacy and security constraints. But Microsoft’s support team has elevated permissions and access to backend systems that we, as community moderators, do not. This ensures your issue is handled with the right tools and expertise and helps you get a faster resolution.    

I hope this information helps. Please try the steps and let me know whether they resolve the issue. If the problem persists, we can work together to find a solution.

Should you have any questions or need further assistance, feel free to share them in the comments so I can continue to support you.

If you found this post helpful, I encourage you to mark it as an accepted solution. This will make it easier for other community members with similar questions to find answers quickly.

Thank you for your kindness and for contributing to the forum. 

Note: Follow the steps in this documentation to enable email notifications if you want to receive email notifications related to this topic.

The error Microsoft.Exchange.Data.Storage.TenantAccessBlockedException / TenantAccessBlockedError indicates that the Microsoft 365/Exchange Online tenant is blocked, typically due to inactivity. Outlook on the web cannot open the mailbox while the tenant is in this state.

To address this, the following actions are required at the tenant level (not on the client device):

1. Confirm the tenant is blocked due to inactivity
   This error commonly aligns with the Entra ID error AADSTS5000225: This tenant has been blocked due to inactivity. When a tenant is made inaccessible due to inactivity, all services that depend on it (including Outlook on the web and Teams) will fail to sign in or load data.
2. If an administrator wants to keep using the tenant – request reactivation
   For tenants blocked due to inactivity:
   • Administrators can request reactivation within 20 days of the tenant entering the inactive state.
   • After 20 days in this state, the tenant is deleted and is not recoverable.
   Required steps for the tenant administrator:
   1. Contact Microsoft support using the global support phone numbers listed at: global support phone numbers (see reference below).
   2. Open a support case requesting tenant reactivation due to inactivity.
   3. Do not open multiple cases for the same issue; wait for Microsoft’s decision on the existing case.
3. If the tenant should not be reactivated
   • No action is required; the tenant will be deleted after 20 days of being inaccessible.
   • Review Microsoft’s data protection policies to understand data handling and deletion behavior.
4. For application owners/developers using this tenant
   While the tenant is blocked:
   • Minimize authentication requests against this tenant until it is reactivated.
   • Do not submit additional assistance requests beyond what the administrator has already opened.
   • Review data protection policies if the tenant will remain deleted.
5. What end users can do
   • If not a tenant administrator, contact the organization’s Microsoft 365/Entra ID administrator and share the full error details (TenantAccessBlockedException, TenantAccessBlockedError).
   • The administrator must work with Microsoft as described above; there is no client-side fix for this condition.

Once Microsoft reactivates the tenant, Outlook on the web and other services (such as Teams) should start working again after propagation completes.

References:

• Tenant inaccessible due to inactivity
• 7 Day Old Azure Account: AADSTS5000225: This tenant has been blocked due to inactivity. - Microsoft Q&A
• Tried loggin into Teams and Outlook and got this message on outlook, and unable to log into teams. - Microsoft Q&A