Examkin

Question

Difficulty: MediumMicrosoft Entra ID Authentication and Conditional Access

An organization named Contoso Pharmaceuticals is designing an identity security strategy for its Microsoft Entra ID tenant. The organization requires that all users with administrative roles use multi-factor authentication (MFA) when accessing the Azure portal. The organization also needs to ensure that administrators are not permanently locked out of the tenant in the event of a Microsoft Entra ID MFA service outage. Which design strategy should the architect recommend?

  1. Implement a Conditional Access policy requiring multi-factor authentication for all administrators, while explicitly excluding a dedicated, cloud-only emergency access account that is monitored for sign-in activity.Answer
  2. B
    Implement a Conditional Access policy requiring multi-factor authentication for all administrators, and use Microsoft Entra Privileged Identity Management (PIM) to configure permanently active role assignments for emergency administrators to bypass the policy.
  3. C
    Deploy Active Directory Federation Services and federated authentication to handle all administrative sign-ins, using on-premises authentication bypasses to grant access if Microsoft Entra multi-factor authentication services are unavailable.
  4. D
    Create a Conditional Access policy requiring multi-factor authentication for all administrative accounts without any exclusions, relying on Microsoft Support to temporarily disable the policy during a tenant lockout.

Answer

Implement a Conditional Access policy requiring multi-factor authentication for all administrators, while explicitly excluding a dedicated, cloud-only emergency access account that is monitored for sign-in activity.
The correct strategy is to create a Conditional Access policy requiring MFA for all administrative roles, but explicitly exclude a dedicated emergency access (break-glass) account. This cloud-only account must bypass MFA so it remains accessible during an outage. Continuous monitoring and alerting must be configured to detect any sign-in attempts using this account, mitigating the risk of MFA bypass.

Step-by-Step Solution

1
Analyze the tenant security requirements and the risk of administrator lockout due to MFA service outages or misconfigurations.
Identify that a fallback mechanism (break-glass account) is necessary to ensure administrative access is maintained.
Microsoft Entra ID Conditional Access policies apply to all targeted users unless explicitly excluded, which can lead to tenant lockout if MFA fails.
2
Design the emergency access account strategy.
Specify a dedicated, cloud-only account that does not sync from on-premises Active Directory and is excluded from the MFA Conditional Access policy.
Cloud-only accounts do not depend on on-premises sync health, and excluding them from the policy ensures they can authenticate without MFA during an outage.
3
Establish auditing and alert mechanisms for the emergency access account.
Configure Azure Monitor logs and Microsoft Entra ID alerts to trigger whenever the emergency access account is used to sign in.
Since the emergency access account bypasses MFA, its use must be highly restricted, audited, and monitored to prevent misuse.

Key Concept

Designing for resiliency in Microsoft Entra ID Authentication and Conditional Access by implementing monitored emergency access accounts.
Estimated Time:1m 30s
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access