Examkin

Question

Difficulty: MediumMicrosoft Entra ID Authentication and Conditional Access

AeroLine Dynamics is designing an administrative access security solution for its Microsoft Entra ID tenant. The solution must enforce Multi-Factor Authentication (MFA) and require a compliant device for all global administrators who access the Azure portal. The design must also ensure that administrators can still access the tenant if the MFA service or the device compliance validation service experiences a global outage. Which of the following strategies should you include in the design?

  1. A
    Implement an on-premises federation infrastructure using Active Directory Federation Services (ADFS) to manage token issuance and policy bypasses for the administrative accounts.
  2. B
    Apply the Conditional Access policy to all users holding the Global Administrator role with no exclusions, relying on Azure support ticket escalation to bypass the policy in the event of an MFA outage.
  3. Create the Conditional Access policy requiring multi-factor authentication (MFA) and compliant devices for all administrators, but exclude a dedicated, cloud-only emergency account that has the Global Administrator role.Answer
  4. D
    Configure Microsoft Entra Privileged Identity Management (PIM) to assign the Global Administrator role as permanently active for the admin accounts to guarantee access during a system outage.

Answer

Create the Conditional Access policy requiring multi-factor authentication (MFA) and compliant devices for all administrators, but exclude a dedicated, cloud-only emergency account that has the Global Administrator role.
Excluding a dedicated, cloud-only emergency access account (often called a glass-breaker account) from Conditional Access policies is a Microsoft best practice. This ensures that if there is a global outage of multi-factor authentication or device compliance validation, administrators can still access the Microsoft Entra tenant using this emergency account to disable or modify the policies. The account should be cloud-only and not federated or synced to prevent dependency on on-premises infrastructure.

Step-by-Step Solution

1
Identify the security requirements and the risk of tenant lockout.
Determined that strict Conditional Access rules without exclusions can block all administrative access during a service outage.
Ensures the architecture accounts for high availability and disaster recovery of administrative access.
2
Select the appropriate account configuration for emergency access.
Designate a dedicated, cloud-only account with the Global Administrator role that is excluded from MFA and compliance policies.
Minimizes dependencies on external or on-premises systems and avoids lockout.
3
Configure the main Conditional Access policy targeting administrators.
Create a policy that enforces Multi-Factor Authentication (MFA) and compliant devices for all Global Administrators, explicitly excluding the emergency access account.
Applies strong security controls to all active administrators while maintaining a break-glass rescue path.

Key Concept

Microsoft Entra ID Conditional Access emergency access accounts
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access