# AADSTS5000225: Tenant blocked due to inactivity (fix)

Canonical: https://brambrinkmeier.com/entra/aadsts/5000225/
By Bram Brinkmeier. JSON: https://brambrinkmeier.com/api/aadsts/5000225.json

**Short answer:** AADSTS5000225 means Microsoft made the whole Microsoft Entra tenant inaccessible because it was inactive. Nobody can sign in to it, admins included. Microsoft's error reference doesn't list it; Microsoft's inactive-tenant page does. An admin can ask Microsoft to reactivate it within 20 days. After that the tenant is deleted and can't be recovered.

**Fix:** Admin: decide now whether you need the tenant, because it is deleted after 20 days. To reactivate, call Microsoft through the support numbers on the inactive-tenant page and open only one request. User: tell an admin now if the tenant is your organization's. Developer: stop retry loops against it.

| Field | Value |
|---|---|
| Code | AADSTS5000225 |
| Category | Guests and tenants |
| Type | Failure |
| Attack signal | Low: usually configuration or user error |
| In Microsoft's error reference | No (checked 2026-10-30) |
| Verification | documentation |
| Last updated | 2026-10-30 |

## What does AADSTS5000225 mean?

Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS5000225 (checked 30 October 2026).

Microsoft documents it on its page [Tenant inaccessible due to inactivity](https://learn.microsoft.com/entra/fundamentals/inaccessible-tenant):

> Error message `Error message: AADSTS5000225: This tenant has been blocked due to inactivity. To learn more about ...` is expected for tenants inaccessible due to inactivity.

Users on Microsoft Q&A quote the full text:

> AADSTS5000225: This tenant has been blocked due to inactivity. To learn more about tenant lifecycle policies, see https://aka.ms/TenantLifecycle

The block is on the tenant, not on a user. Microsoft's reason: *"Configured tenants no longer in use might still generate costs for your organization. Making a tenant inaccessible due to inactivity helps reduce unnecessary expenses."*

The deadline is short. Microsoft: *"Administrators can request a tenant to be reactivated within 20 days of the tenant entering an inactive state. Tenants that remain in this state for longer than 20 days are deleted."* And: *"The tenant is deleted after 20 days of being inaccessible due to inactivity and it isn't recoverable."*

Microsoft's page doesn't say what counts as inactive. Moderators on Q&A marked as Microsoft External Staff write that the tenant *"has been inactive for over 200 days past the billing cycle"*. That figure is not on Microsoft's documentation page, so treat it as a support answer, not a documented rule.

## Is it an attack?

No. Microsoft blocked the tenant. Nobody did it to you.

| Pattern | Likely meaning |
|---|---|
| A test, trial or developer tenant nobody used for months | The normal case. If you still need it, act within 20 days. |
| A personal Microsoft account that still belongs to a former employer's tenant | A user on Q&A reports this when trying to leave the organization so they could delete their account. Their own account isn't blocked; the old tenant is. |
| An app that signs in to a customer's or partner's tenant suddenly gets this | That tenant was blocked. It is their admin's problem, not yours. |
| A production tenant you use every day | Unexpected. Open a case with Microsoft straight away. |

## How do I find it in my logs (KQL)?

Microsoft doesn't document where 5000225 is logged. Our reading: if your own tenant is blocked you can't sign in to read its logs, and a sign-in to someone else's blocked tenant is logged there if anywhere, not in yours. If your workspace still receives data, this check is expected to return nothing:

```kusto
union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
| where TimeGenerated > ago(30d)
| where ResultType == "5000225"
| summarize Rows = count(), Apps = make_set(AppDisplayName, 10) by SourceTable
```

## How do I fix AADSTS5000225?

**For the user:** you can't fix it. If the tenant belongs to your organization, tell an admin now, because of the 20-day limit. If it belongs to a former employer or a test you no longer need, you can ignore it. A user on Q&A who wanted to leave such a tenant was advised by another user, not by Microsoft, to contact Microsoft support.

**For developers and app owners:** Microsoft says to *"minimize the number of authentication requests sent to this deactivated tenant until the tenant is reactivated."* Stop retry loops against it. Don't open more than one support request; Microsoft says it contacts you once a decision is made.

**For admins:**
1. Decide quickly whether you need the tenant. After 20 days it is deleted and can't be recovered.
2. To reactivate, contact Microsoft through the global support phone numbers linked from Microsoft's inactive-tenant page. Microsoft asks you to *"refrain from submitting another assistance request while your existing case is in process and until you receive a response with a decision on this case."*
3. Have the details ready. A Microsoft External Staff moderator on Q&A asked for the tenant ID, the error code, the correlation ID and timestamp of a recent failure, and a business justification.
4. If it was only a test tenant, the same moderator's advice is to create a new one instead.
5. If you don't plan to reactivate it, review Microsoft's data protection policies, which the page links to.

## Evidence

Not in Microsoft's error reference and not reproduced in the lab; built from lab results, other Microsoft pages and user reports, which the page names.

## Sources

1. [Microsoft Entra authentication and authorization error codes](https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes)
2. [Tenant inaccessible due to inactivity](https://learn.microsoft.com/entra/fundamentals/inaccessible-tenant)
3. [Microsoft Q&A: "This tenant has been blocked due to inactivity."](https://learn.microsoft.com/en-us/answers/questions/2277991/this-tenant-has-been-blocked-due-to-inactivity)
4. [Microsoft Q&A: error code aadsts5000225](https://learn.microsoft.com/en-us/answers/questions/5888963/error-code-aadsts5000225)

## Related codes

[AADSTS90002](https://brambrinkmeier.com/entra/aadsts/90002/), [AADSTS700016](https://brambrinkmeier.com/entra/aadsts/700016/), [AADSTS50034](https://brambrinkmeier.com/entra/aadsts/50034/), [AADSTS5000224](https://brambrinkmeier.com/entra/aadsts/5000224/)

## License and citation

CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.

Cite as: Bram Brinkmeier, "AADSTS5000225: Tenant blocked due to inactivity (fix)", https://brambrinkmeier.com/entra/aadsts/5000225/ (CC BY 4.0), last updated 2026-10-30.