Question

Difficulty: EasyMicrosoft Entra ID Authentication and Conditional Access

An organization is designing a Microsoft Entra Conditional Access policy to require multi-factor authentication (MFA) for all administrative roles. The organization wants to ensure that administrators do not get locked out of the tenant in the event of a tenant-wide disruption or MFA service outage. Which of the following recommendations should you include in the identity security design?

  1. A
    Apply the policy to all administrative accounts without any exclusions to ensure complete security coverage.
  2. B
    Configure emergency administrator accounts with permanently active Global Administrator roles in Privileged Identity Management (PIM).
  3. Exclude a dedicated emergency access account from the Conditional Access policy.Answer
  4. D
    Deploy Active Directory Federation Services (AD FS) to authenticate administrators during Entra ID outages.

Answer

Exclude a dedicated emergency access account from the Conditional Access policy.
Excluding a dedicated emergency access account from the Conditional Access policy ensures that there is at least one administrative path into the tenant that does not depend on the availability of the MFA service or external authentication endpoints.

Step-by-Step Solution

1
Analyze the requirement to prevent administrator lockout during tenant-wide or MFA-specific service disruptions.
Identify that policies requiring MFA must have a mechanism to bypass MFA in absolute emergencies.
If MFA is globally down or misconfigured, administrators need a path to access the tenant and correct the configuration.
2
Review Microsoft best practices for managing emergency access in Microsoft Entra ID.
Confirm that creating one or two dedicated, highly secure emergency access (break-glass) accounts that are excluded from all Conditional Access policies is the standard mechanism to prevent lockout.
These accounts are kept excluded from CA policies and monitored closely for any sign-in activity.

Key Concept

Emergency access accounts (break-glass accounts) should be excluded from Conditional Access policies that enforce MFA to prevent tenant lockout.
Estimated Time:50s
Rate this question