Examkin

Question

Difficulty: MediumMicrosoft Entra ID Authentication and Conditional Access

Tailwind Traders is designing an identity security strategy for its Microsoft Entra ID tenant. The organization plans to implement a Conditional Access policy that requires Multi-Factor Authentication (MFA) for all users when accessing Azure management portals. The architect must ensure that administrators do not get locked out of the tenant if there is an outage of the MFA service or if the policy is misconfigured. Which of the following configurations should the architect include in the security design?

  1. Create a dedicated, cloud-only emergency access account that is excluded from the Conditional Access policy.Answer
  2. B
    Establish an Active Directory Federation Services (AD FS) infrastructure with on-premises multi-factor authentication as the backup authentication method.
  3. C
    Configure Privileged Identity Management (PIM) to assign the Global Administrator role as permanently active for a secondary admin account.
  4. D
    Apply the Conditional Access policy to all users and administrators without exclusions, and rely on Microsoft Support to bypass the policy during an emergency.

Answer

Create a dedicated, cloud-only emergency access account that is excluded from the Conditional Access policy.
The correct configuration is to create a dedicated, cloud-only emergency access account that is excluded from the Conditional Access policy. Microsoft best practices recommend having at least two emergency access accounts that are excluded from Conditional Access policies to prevent lockout during service outages or policy misconfigurations.

Step-by-Step Solution

1
Identify the risk of tenant-wide lockout when requiring MFA via Conditional Access policies.
Recognized that policy misconfigurations or MFA service outages can prevent all administrators from authenticating.
Establishing a mitigation path is necessary to maintain tenant management access under failure conditions.
2
Select the appropriate mitigation mechanism according to Microsoft best practices.
Determine that creating a dedicated, cloud-only emergency access account (break-glass account) is the standard method.
Cloud-only accounts do not rely on on-premises sync, and separating them from standard policies avoids policy-induced lockouts.
3
Exclude the emergency access account from all tenant-wide Conditional Access MFA policies.
The break-glass account is excluded from the policy scope, ensuring it can log in using password-only credentials during emergencies.
This exclusion prevents the account from being blocked by the very policy or service outage that caused the lockout.

Key Concept

Microsoft Entra ID emergency access accounts are critical for preventing tenant lockout when designing Conditional Access policies.
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access