An organization is designing a Microsoft Entra Conditional Access policy to require multi-factor authentication (MFA) for all administrative roles. The organization wants to ensure that administrators do not get locked out of the tenant in the event of a tenant-wide disruption or MFA service outage. Which of the following recommendations should you include in the identity security design?
- AApply the policy to all administrative accounts without any exclusions to ensure complete security coverage.
- BConfigure emergency administrator accounts with permanently active Global Administrator roles in Privileged Identity Management (PIM).
- Exclude a dedicated emergency access account from the Conditional Access policy.Answer
- DDeploy Active Directory Federation Services (AD FS) to authenticate administrators during Entra ID outages.
Answer
Exclude a dedicated emergency access account from the Conditional Access policy.
Excluding a dedicated emergency access account from the Conditional Access policy ensures that there is at least one administrative path into the tenant that does not depend on the availability of the MFA service or external authentication endpoints.
Step-by-Step Solution
Key Concept
Emergency access accounts (break-glass accounts) should be excluded from Conditional Access policies that enforce MFA to prevent tenant lockout.
Estimated Time:50s