Locked out MS365 - use MS365 Connector to regain access?

Apps & App Center
#1

Hi Community,

i have signed a free MS365 Test-Account from MS to test an upgrade of an old UCS with MS365 Connector.
The update worked good but now i have an other silly problem:

I have lost the MS 2nd Faktor for the MS Test-Account and have no chance to cancel the 1-month-free test account. I tried the whole day to regain access, reach MS or something, but no success.

Now i have one last idea:

From the upgrade test, i have a working installation of the UCS MS365 Connector
Can someone think of a way to create an Account with Admin-Rights at MS through the Connector or using its Keys?
Yours, Gerd

#2

As far as I remember and last time I looked for such a thing in Azure AD:
Role assignment i.e. for global administrator in a tenant isn’t possible for user objects automatically. There is a concept for role assignment for Microsoft 365 groups - the type of groups that are only created in Azure AD and not synchronized from UCS or Windows AD.[1] (I guess there might be workarounds using dynamic group assignment, with role assignment enabled, but I don’t think you’d have configured that ahead of this.)

To be honest, it’s not just Microsoft who doesn’t readily support such a thing. I’ve seen a couple of services where user synchronization / provisioning is possible, but not (admin rights) role assignment.

There is a strong recommendation of keeping a cloud-only “break glass” account, that what would have made it simpler, exactly for that situation when you lose your on-prem directory synchronization (be it Univention MS 365 connector or Azure AD connect).

[1] Use Azure AD groups to manage role assignments - Microsoft Entra | Microsoft Learn
[2] Manage emergency access admin accounts - Microsoft Entra | Microsoft Learn

Mastodon