Examkin

Question

Difficulty: MediumMicrosoft Entra ID Authentication and Conditional Access

ValoSpan Logistics is planning the deployment of a security model for their Microsoft Entra ID tenant. The security team wants to apply a Conditional Access policy that enforces Multi-Factor Authentication (MFA) for all administrative roles to protect privileged identities. However, the system design must guarantee that administrators can access the tenant if the primary MFA cloud service becomes completely unavailable. Which option should you recommend to prevent administrator lockout while maintaining a secure posture?

  1. A
    Deploy Active Directory Federation Services (AD FS) to federate the tenant, allowing administrative authentication to bypass Entra ID Conditional Access during Multi-Factor Authentication (MFA) outages.
  2. Create two dedicated emergency access accounts, assign them the Global Administrator role, and explicitly exclude these accounts from the Conditional Access policy requiring Multi-Factor Authentication (MFA).Answer
  3. C
    Configure the administrative roles as permanently active assignments in Microsoft Entra Privileged Identity Management (PIM) to ensure they bypass policy evaluations during authentication.
  4. D
    Apply the Conditional Access policy requiring Multi-Factor Authentication (MFA) to all administrative accounts without exclusions, and configure security questions as the secondary verification method for recovery.

Answer

Create dedicated emergency access accounts, assign them the Global Administrator role, and exclude them from the Conditional Access policy requiring Multi-Factor Authentication (MFA).
The correct recommendation is to create dedicated, cloud-only emergency access accounts (commonly referred to as break-glass accounts) and exclude them from all Conditional Access policies that require Multi-Factor Authentication (MFA). This ensures that if the MFA service is unavailable, administrators can still access the tenant using these break-glass accounts to troubleshoot or disable policies. Best practices dictate having at least two such accounts, storing their credentials securely in separate physical locations, and monitoring their usage.

Step-by-Step Solution

1
Analyze the identity requirements and identify the need for emergency recovery access (break-glass accounts) during a Multi-Factor Authentication (MFA) service disruption.
Identified that enforcing MFA for all administrators without exclusions risks tenant lockout during an outage.
To prevent lockout, at least one administrative path must remain available without requiring MFA.
2
Select the correct design implementation by excluding dedicated emergency access accounts from the Conditional Access MFA policies.
Created a policy exclusion for two cloud-only accounts with the Global Administrator role.
This isolates the break-glass accounts from MFA requirements while keeping all other administrative accounts secured by MFA.
3
Verify that alternative methods like Privileged Identity Management (PIM) permanent roles or Active Directory Federation Services (AD FS) do not securely resolve the lockout risk.
Rejected permanent PIM assignments and AD FS deployment due to security risks and infrastructure overhead.
Ensures the solution aligns with Microsoft security and design best practices.

Key Concept

Conditional Access Policies and Emergency Access Accounts
Estimated Time:1m 30s
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access