Why can’t User Administrator enable a disabled account in Entra ID?

Look beyond the user’s direct role assignments. Check the user’s application assignments and group memberships, especially groups configured to assign Entra roles. Membership in one of those privileged groups can cause the account to be treated as an administrator and prevent User Administrator from enabling it.

In my case, the issue wasn’t Entra permissions at all. Our outsourced security service had locked the account after detecting an unapproved VPN. A Global Administrator could make the account appear enabled in Entra, but the security platform immediately kept it disabled in the background. Clearing the lockout in that system resolved the problem.

First check whether the target account has any administrative role assigned, including an eligible role through PIM. User Administrator generally can’t manage accounts that are considered privileged. Also make sure your own User Administrator role is activated if it’s assigned through PIM.