Examkin

Question

Difficulty: MediumMicrosoft Entra ID Authentication and Conditional Access

Apex Aerospace is designing a Microsoft Entra ID identity strategy. The organization plans to implement a strict Conditional Access policy that requires Multi-Factor Authentication (MFA) for all administrative roles. The security team wants to ensure that administrators can still access the tenant to resolve configuration issues or during a cloud-based MFA service outage. Which design option should you recommend?

  1. A
    Configure all administrative roles as eligible for activation in Microsoft Entra Privileged Identity Management (PIM) and rely on the activation workflow without any Conditional Access policy exclusions.
  2. Create two dedicated emergency access accounts, assign them the Global Administrator role, and exclude them from the Conditional Access policies requiring MFA.Answer
  3. C
    Deploy an Active Directory Federation Services (AD FS) infrastructure to federate the tenant, routing all administrator authentication requests to on-premises servers to bypass Azure MFA.
  4. D
    Configure all administrator accounts with permanently active role assignments in Privileged Identity Management (PIM) to ensure they bypass the need for elevation during a disaster.

Answer

Create two dedicated emergency access accounts, assign them the Global Administrator role, and exclude them from the Conditional Access policies requiring MFA.
Creating dedicated emergency access accounts (break-glass accounts) and excluding them from the Conditional Access policies that enforce MFA ensures that administrators have a fallback mechanism to sign in and resolve configuration issues or outages without requiring MFA.

Step-by-Step Solution

1
Analyze the lockout risk associated with enforcing MFA on all administrative accounts.
Identify that a service outage or misconfiguration affecting Microsoft Entra MFA would prevent all administrators from signing in.
This establishes the need for a bypass or recovery mechanism that does not depend on MFA.
2
Evaluate Microsoft's best practices for tenant emergency management.
Determine that Microsoft recommends creating at least two dedicated emergency access accounts (break-glass accounts) that are highly monitored, rarely used, and excluded from MFA requirements.
Excluding these accounts from Conditional Access MFA policies ensures they can authenticate even if the MFA service is entirely unavailable.
3
Select the option that aligns with the emergency access account configuration.
Select the option advocating for the creation and exclusion of emergency access accounts.
This meets the security and availability requirements without introducing unnecessary hybrid infrastructure like AD FS or violating least privilege via PIM active assignments.

Key Concept

Microsoft Entra ID emergency access accounts
Estimated Time:2m 0s
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access