Your company is designing a Microsoft Entra Conditional Access policy to secure administrative access. The policy must require multi-factor authentication (MFA) for all users with privileged roles. You also need to ensure that administrators are not locked out of the tenant if a cloud-based MFA service outage occurs.
Which two configurations should you include in the design?
- Exclude a dedicated emergency access account from the Conditional Access policyAnswer
- Configure the Grant control in the Conditional Access policy to require multi-factor authenticationAnswer
- CRequire multi-factor authentication for the emergency access accounts under all conditions
- DAssign the administrative roles permanently to users using Privileged Identity Management (PIM)
Answer
Exclude a dedicated emergency access account from the Conditional Access policy and configure the Grant control in the Conditional Access policy to require multi-factor authentication.
Excluding a dedicated emergency access account and requiring multi-factor authentication under Grant controls satisfies both security and business continuity requirements. The exclusion ensures resilience against MFA outages, while the Grant control enforces the required MFA verification for general administrative sessions.
Step-by-Step Solution
Key Concept
Microsoft Entra ID Conditional Access controls and lockout prevention using emergency access accounts.