An organization is designing a security solution for their Microsoft Entra ID tenant to protect administrative accounts. The organization wants to enforce multi-factor authentication (MFA) for all administrators while ensuring that they do not lock themselves out of the tenant if there is an authentication services outage. Which two configurations should you include in the design? (Select two.)
- A Conditional Access policy that requires multi-factor authentication (MFA) for all administrative directory rolesAnswer
- An exclusion for a dedicated emergency access account from the multi-factor authentication (MFA) Conditional Access policyAnswer
- CA Privileged Identity Management (PIM) configuration that makes the emergency access account permanently active in its administrative role
- DAn Active Directory Federation Services (AD FS) infrastructure to manage authentication for all administrator accounts
Answer
To protect administrative accounts while preventing tenant lockout, you should configure a Conditional Access policy that requires multi-factor authentication (MFA) for all administrative roles and exclude a dedicated emergency access account from that policy.
Securing administrative roles with Conditional Access MFA enforces strong security, while excluding a dedicated emergency access account prevents administrative lockout in the event of an MFA service disruption.
Step-by-Step Solution
Key Concept
Microsoft Entra ID Conditional Access policies and emergency access account design