Locked myself out of Entra ID domain, cannot remove Federation (Google as IdP)

Ammar Aganovic 60 Reputation points
2023-12-12T22:26:02.09+00:00

Hi!

In the process of trying to setup Google as IdP and Azure as SP, I ended up breaking something and now noone from the domain can login ;(.

When trying to login to MS services, users enter their username, but and then greeted with "Choose a way to sign in" any no options whatsoever.

In order to run any of the relevant federation powerhsell commands, I need to be logged in with the domain Global Admin, but it fails as mentioned above.

I am logged in Azure Portal, but I see no trace of any Google IdP I could remove manually.

I can login using other domains but it doesn't have the scope beyond the logged in domain.

I might try to run "Remove-MgDomainFederationConfiguration" but it requires "InternalDomainFederationId" which I don't know where to find in Azure Portal. The command probably wouldn't run anyway, due to wrong domain of the logged in user.

Any idea how to fix it?

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,219 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,368 questions
0 comments
Accepted answer
  1. Sandeep G-MSFT 16,361 Reputation points Microsoft Employee
    2023-12-14T04:13:24.9066667+00:00

    @Ammar Aganovic

    I'm glad that support team was able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "[The question author cannot accept their own answer. They can only accept answers by others] (https://docs.microsoft.com/en-us/answers/support/accepted-answers#why-only-one-accepted-answer)**)", I'll repost your solution in case you'd like to "[Accept] (https://docs.microsoft.com/en-us/answers/support/accepted-answers#accepted-answer-in-a-question-thread)**)" the answer.

    Solution:

    Had to run below command to resolve the issue.

    Update-MgDomain -DomainId <domain name> -AuthenticationType "Managed"

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    0 comments

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andy David - MVP 144.4K Reputation points MVP
    2023-12-12T22:29:35.2733333+00:00
  2. Sandeep G-MSFT 16,361 Reputation points Microsoft Employee
    2023-12-13T11:22:25.74+00:00

    @Ammar Aganovic

    Thank you for posting this in Microsoft Q&A.

    As I understand you tried federate Azure AD with Google IDP. Something went wrong and not you are unable to login to Azure portal.

    You want to revert the federation and get the Azure AD domain back to managed where Azure AD will authenticate the user.

    In this situation since you do not have access to the admin credentials to run the command or you do not know "InternalDomainFederationId", you can reach out to our support team. You can look into below article to get support numbers depending on your country.

    https://support.microsoft.com/en-us/topic/global-customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2

    or creating a ticket through a different account:  https://video2.skills-academy.com/en-us/microsoft-365/admin/get-help-support?view=o365-worldwide#phone-support

    Create a ticket with Microsoft support team. Give them the tenant ID which is locked out in your description. Tell them that no admin account has access anymore and your partners also have no access anymore.

    Once you create a ticket with support team you will have to work with our data protection team. You will have to first prove your identity against your tenant for security purpose. Post that this team will help you with help you in getting access to your tenant or unlock your account depending on your scenario.

    Also, for the future, you can create an emergency access account (break glass) in Azure AD. This account will help prevent being accidentally locked out of your Azure Active Directory (Azure AD) organization because you can't sign in for any reason.

    https://docs.microsoft.com/en-us/azure/active-directory/roles/security-emergency-access

    Let me know if you have any further questions.

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.