One of my colleagues signed in this morning and got the message "It looks like your account has been blocked. Please contact your admin to unblock it." Nobody deliberately disabled them as far as I know. I am the tenant admin, so where do I look to see why the sign-in is blocked, and how do I turn it back on? Also, is the account gone or is their email and data still safe?
Office 365 Sign-In Blocked for a User: How to Unblock the Account
Resolved
Cloud
CM
Community Member August 02, 2026
5 replies
1,354 views
Reviewed by moderators
5 Answers
Relax on the data first: a blocked sign-in does not delete anything. The account, mailbox, files and license all stay exactly as they were. Blocking sign-in just stops the person from authenticating, it is a security switch, not a deletion. So once you unblock, everything is right where they left it.
A sign-in can be blocked two ways: an admin flipped it manually, or Microsoft blocked it automatically after too many wrong password attempts or unusual/suspicious activity. Either way the fix is the same, you re-enable sign-in from the admin center.
Here is the direct fix in the Microsoft 365 admin center:
Sign in at admin.microsoft.com as an admin, go to Users, then Active users, and click the person's display name to open their pane. At the top select Unblock sign-in, then in the screen that appears clear "Block this user from signing in" and choose Save changes. That is it, the account is allowed again.
One thing to warn the user about: after unblocking, they may need to wait around 30 minutes before every Microsoft 365 service lets them back in. Signing in too soon can throw a redirect error, so give it time.
If it was an automatic lockout rather than a manual block, two extra steps usually clear it:
Reset the password from the same Active users pane (the key icon), which resolves lockouts caused by repeated wrong passwords or an expired password. And if unblocking alone does not stick, reset the sign-in status, flip it to Block, Save, then Unblock, Save again. Toggling it forces the status to refresh cleanly.
You can also do this in Microsoft Graph PowerShell if you prefer scripting or need to handle several users at once. Connect with an account holding the User Administrator or Global Administrator role, then update the sign-in status:
Update-MgUser -UserId user@yourdomain.com -AccountEnabled:$true
Set it to $false to block, $true to unblock. This is handy when you need to enable or disable many accounts in one go rather than clicking each one in the portal.
Two gotchas worth knowing. First, if you run a hybrid setup with on-premises Active Directory, the account state syncs from on-prem. If it keeps re-blocking after you unblock it in the cloud, the user is still disabled in Active Directory Users and Computers on-prem, enable them there and let it sync.
Second, if the blocked account is your only Global Administrator and you are locked out entirely, you cannot self-rescue from the portal, you will need to contact Microsoft 365 support by phone to regain access.