I'm trying to re-enable a disabled user account in Microsoft Entra ID. Documentation indicates that the User Administrator role should be able to manage users, but selecting the account produces a "No access" message. I tested this with broad user-management permissions and Global Administrator assigned, although Privileged Identity Management was not activated during the test. Has anyone encountered this behavior or found what prevents User Administrators from enabling the account?
3 Answers
Look at the user’s application assignments and Microsoft 365 group memberships too. If the user belongs to a group with “Microsoft Entra roles can be assigned to this group” enabled, Entra may treat the account as privileged, which can prevent a User Administrator from re-enabling it.
In my case, the account was being locked by our outsourced security service after the user connected through an unapproved VPN. That external lockout prevented User Administrators from enabling the account. A Global Administrator could make it appear enabled in Entra, but the account remained disabled behind the scenes until the security-service lockout was cleared. Check any identity-protection or endpoint-security tools that may be enforcing the disablement.
First check whether the target account has an administrator role assigned or is eligible for one. User Administrators generally can’t manage accounts that are considered privileged. Also verify that your User Administrator role is activated in PIM if the assignment is eligible.
The security team should make sure those lockout alerts are visible to the administrators, otherwise the Entra symptoms can be very misleading.