Your company is designing a Microsoft Entra Conditional Access policy to secure administrative access. The policy must require multi-factor authentication (MFA) for all users with privileged roles. You also need to ensure that administrators are not locked out of the tenant if a cloud-based MFA service outage occurs.
Which two configurations should you include in the design?
- Exclude a dedicated emergency access account from the Conditional Access policyCevap
- Configure the Grant control in the Conditional Access policy to require multi-factor authenticationCevap
- CRequire multi-factor authentication for the emergency access accounts under all conditions
- DAssign the administrative roles permanently to users using Privileged Identity Management (PIM)
Cevap
Exclude a dedicated emergency access account from the Conditional Access policy and configure the Grant control in the Conditional Access policy to require multi-factor authentication.
Excluding a dedicated emergency access account and requiring multi-factor authentication under Grant controls satisfies both security and business continuity requirements. The exclusion ensures resilience against MFA outages, while the Grant control enforces the required MFA verification for general administrative sessions.
Adım Adım Çözüm
Anahtar Kavram
Microsoft Entra ID Conditional Access controls and lockout prevention using emergency access accounts.