Entra blocks administrators from disabling their own accounts
Reviewed by Helen Jones
On 14 September 2026, Office 365 for IT Pros documented tests where Microsoft Entra rejected attempts by a signed-in administrator to disable their own account. The Entra admin center and Microsoft Graph PowerShell both produced misleading errors even when the account had broad permissions; Microsoft’s current guidance separately says User Administrator can disable non-admin users, while Privileged Authentication Administrator is required for administrator accounts.
Microsoft documents the roles needed to disable ordinary and administrator accounts, but the error shown during a self-disable attempt points at the accountEnabled property rather than the real safeguard. That can make a correctly formed request look like a broken command or software problem. For a small Microsoft 365 admin team, the useful distinction is operational: do not troubleshoot the property first when the target is the signed-in admin account. Use a separate authorised admin identity, confirm the target’s role status, and keep the recovery path outside the account being changed.
Analysis
Update the emergency access runbook so an authorised administrator can disable another admin account from a separate identity. Test the role and sign-in path with a non-production account before relying on it during an incident.
Source note
Pulse published by Collab365 Spaces, reviewed by Helen Jones on . Cite as "Entra blocks administrators from disabling their own accounts", Collab365 Spaces.