Microsoft Data Protection Team Policies and Out-of-Scope Scenarios:
What is the Microsoft Data Protection Team?
The Microsoft Data Protection Team is a specialized unit responsible for resolving tenant access and identity-related issues. They operate strictly under internal security protocols and can only work with Global Administrators (GAs) listed on the tenant.
Note: Microsoft’s policies do not permit partner involvement, including TD SYNNEX, even if the partner has been authorized by the GA.
Microsoft Data Protection Team Policy:
“Our unique security procedures, vetted by CELA and product team, are exclusive to our ‘Data Protection Team’ and relies on the information within the tenant to verify account ownership.
These procedures enable us to handle sensitive information with the utmost confidentiality and implement security measures to protect against potential threats.
Data Protection support Team is uniquely positioned to provide assistance with the tenant access issues, as this security process must be done strictly with the Global administrators listed on the tenant.
Our strict adherence to confidentiality in our procedures and processes cannot involve any partner associated with the business regardless of if he has the authorization to work on behalf of the global administrator.”
Preventing Tenant Lockouts: Best Practices
To avoid the out-of-scope scenarios described below, Microsoft strongly recommends implementing preventive measures. Following these guidelines can help you maintain continuous access to your tenant and avoid costly lockout situations.
Critical Prevention Steps
1. Maintain Multiple Global Administrators
- Recommended: Have at least 2-3 Global Administrators on every tenant
- Ensures business continuity if one admin loses access
- Distribute admin accounts across different individuals in your organization
2. Enable Break Glass (Emergency Access) Accounts
- Create dedicated emergency access accounts that bypass conditional access policies
- Store credentials securely in a physical safe or secure password manager
- Test these accounts regularly to ensure they work when needed
- 📖 Learn more: Microsoft Emergency Access Account Best Practices
3. Set Up MFA with Multiple Methods
- Register multiple MFA devices for each Global Administrator
- Use a combination of: Authenticator app, Phone call, SMS, Hardware tokens
- Keep backup authentication methods up to date
4. Configure MFA Recovery Options
- Set up alternative email addresses and phone numbers
- Regularly verify that recovery contact information is current
- Document and securely store recovery codes
5. Implement Conditional Access Exclusions Carefully
- Exclude emergency access accounts from Conditional Access policies
- Test policies before applying to all Global Administrators
- Document all Conditional Access configurations
6. Regular Access Reviews
- Periodically verify that all Global Administrators still require access
- Ensure contact information is up to date
- Test emergency access procedures quarterly
📚 Complete Microsoft GDAP Prevention Guide
For comprehensive guidance on preventing tenant lockouts, including detailed implementation steps, refer to Microsoft's official documentation:
🔗 Preventing Tenant Lockouts - Microsoft Partner Center
This guide covers:
- Detailed break glass account setup
- Conditional Access policy configuration
- MFA best practices for partners
- Emergency recovery procedures
- GDAP (Granular Delegated Admin Privileges) considerations
Out-of-Scope Scenarios
The following scenarios are outside the scope of TD SYNNEX or Microsoft’s standard Cloud Support (Break & Fix Team) and must be handled directly by Microsoft’s Data Protection Team.
Scenario 1: Unable to Access Tenant due to Conditional Access Policy
- Issue must be handled by Microsoft’s Data Protection Team.
- Only Global Administrators listed on the tenant may work with Microsoft.
- Partners are not allowed to participate in the process.
Scenario 2: Domain Takeover / Remove Domain from Another Tenant (Not Managed by TD SYNNEX)
- Raise a support request with Microsoft directly and: Specify the domain in question. Ask Microsoft to create a ticket on behalf of the current tenant where the domain is located.
- Resolution requires the involvement of the Global Administrators of that tenant only.
Action for Scenarios 1 & 2:
Contact Microsoft Support directly to initiate the process.
🔗 Global Customer Service phone numbers – Microsoft Support
Scenario 3: Global Administrator Forgot Password and No Other GA Exists
- Out of scope for TechCARE 24x7 Cloud Support Team.
- Please contact your TD SYNNEX CSP Account Manager.
Scenario 4: Global Administrator Lost MFA Device and No Backup GA Exists
- If no other Global Administrator exists in the tenant and access is lost due to MFA: This is also out of scope for standard support. Please contact your TD SYNNEX CSP Account Manager. for assistance.