Examkin

Question

Difficulty: EasyMicrosoft Entra ID Authentication and Conditional Access

Your organization is designing a security strategy for a Microsoft Entra ID tenant. You plan to deploy a Conditional Access policy that requires Multi-Factor Authentication (MFA) for all users assigned directory role administrator privileges. To prevent administrative lockout during a service outage or configuration error, which design decision should you implement?

  1. A
    Apply the Conditional Access policy to all administrative accounts, including emergency access accounts, to ensure complete security coverage.
  2. B
    Deploy Active Directory Federation Services (AD FS) on-premises to manage authentication exclusions for cloud-only administrators.
  3. Exclude a dedicated emergency access account from the Conditional Access policy.Answer
  4. D
    Configure all administrator role assignments as permanently active instead of eligible to bypass multi-factor authentication requirements.

Answer

Exclude a dedicated emergency access account from the Conditional Access policy.
Excluding a dedicated emergency access (break-glass) account from the Conditional Access policy allows administrators to regain access to the Entra ID tenant to disable or adjust policies if a service outage or misconfiguration prevents standard authentication.

Step-by-Step Solution

1
Identify the primary risk of enforcing tenant-wide administrator MFA.
The main risk is administrative lockout if the MFA service is offline or if a policy is misconfigured.
Administrators would have no way to log in and disable the faulty policy.
2
Determine the Microsoft best practice for preventing administrative lockout.
Create a dedicated emergency access (break-glass) account that is excluded from MFA policies.
This account acts as a fallback to restore access and adjust policies in emergencies.
3
Select the option that aligns with the exclusion requirement.
Excluding a dedicated emergency access account from the Conditional Access policy.
It fulfills the requirement to prevent lockout while keeping standard administrator accounts secured under MFA.

Key Concept

Excluding emergency access (break-glass) accounts from Conditional Access policies is critical to prevent complete administrative lockout in Microsoft Entra ID.
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access