Examkin

Question

Difficulty: MediumMicrosoft Entra ID Authentication and Conditional Access

Solaris Green Energy is designing an identity security strategy for its Microsoft Entra ID tenant. The design must enforce multi-factor authentication (MFA) for all administrative roles to protect resources from unauthorized access. To mitigate the risk of tenant lockout during an identity service outage or misconfiguration, the security team requires an emergency access plan.

Which of the following recommendations should you include in the identity design?

  1. Designate two cloud-only accounts, assign them the Global Administrator role, and exclude them from all Conditional Access policies that require multi-factor authentication.Answer
  2. B
    Designate two cloud-only accounts, assign them the Global Administrator role, and include them in the scope of all Conditional Access policies that require multi-factor authentication to maintain a uniform security posture.
  3. C
    Configure all administrative roles in Microsoft Entra Privileged Identity Management (PIM) with permanently active assignments instead of eligible assignments to ensure emergency access.
  4. D
    Deploy Active Directory Federation Services (AD FS) on-premises to authenticate the emergency access accounts and enforce federated multi-factor authentication.

Answer

Designate two cloud-only accounts, assign them the Global Administrator role, and exclude them from all Conditional Access policies that require multi-factor authentication.
Designating two cloud-only accounts, assigning them the Global Administrator role, and excluding them from all Conditional Access policies that require multi-factor authentication is the recommended Microsoft best practice. These 'break-glass' accounts ensure that at least one administrator can access the tenant to remediate configurations or service outages, even if the primary authentication mechanisms or multi-factor authentication systems are unavailable.

Step-by-Step Solution

1
Analyze the requirements for administrative MFA enforcement and tenant lockout prevention.
Identified that while MFA must be enforced for administrators, a recovery mechanism (emergency/break-glass accounts) must be established to bypass MFA during policy misconfigurations or service outages.
This establishes the need for accounts that are decoupled from standard authentication paths and policies.
2
Evaluate the architectural constraints of the emergency accounts.
Determined that these accounts must be cloud-only (to avoid on-premises federation dependencies) and excluded from Conditional Access policies enforcing MFA.
Cloud-only accounts operate independently of on-premises sync issues, and excluding them from CA policies prevents lockout if a policy is configured incorrectly.
3
Compare design recommendations against administrative security governance.
Selecting the option that uses cloud-only accounts excluded from MFA policies satisfies the requirement, while other options either create lockout risks, misconfigure PIM, or introduce unnecessary on-premises dependencies.
Provides a robust, compliant emergency access design aligned with Microsoft architectural best practices.

Key Concept

Emergency access accounts (break-glass accounts) design in Microsoft Entra ID
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access