Create two emergency access accounts, exclude them from every policy and alert on their use¶
Licence and role
Accounts: any edition. Alert rule: Azure Monitor / Log Analytics (pay-as-you-go ingestion, usually small).
Why it matters¶
A Conditional Access mistake can lock every administrator out of the tenant. Microsoft recommends at least two cloud-only emergency access accounts, excluded from policies that block or restrict access, protected with a passkey (FIDO2) or certificate-based authentication, and monitored so every sign-in raises an alert.
Steps¶
- Create two cloud-only accounts on the *.onmicrosoft.com domain with the Global Administrator role assigned permanently. Do not tie them to a person, phone or federated domain.
- Register a passkey (FIDO2 security key) or certificate-based authentication for each account and store the keys in two separate safe places.
- Create a group (for example EmergencyAccess) with both accounts and exclude that group from every Conditional Access policy that blocks or restricts access.
- Send sign-in logs to Log Analytics and create an alert rule: SigninLogs where the UserId is one of the two accounts, severity 0, action group that emails and texts the security team.
- Put a 90-day review in the calendar: sign in with each account, confirm the alert fires, and check the accounts are still excluded.
Impact on users¶
None for users. Two privileged accounts exist that bypass policy, which is why they need strong keys and alerting.
Rollback¶
Remove the accounts from the role and disable them if the organisation decides on another recovery process. Do not remove the exclusion while the accounts exist.
Read-only check¶
Reads settings only. It changes nothing in your tenant or on the device.
Modules, connection and role
Requires: Microsoft.Graph PowerShell SDK (Microsoft.Graph.Identity.SignIns, .Reports, .Identity.DirectoryManagement).
Connect first:
Connect-MgGraph -Scopes Policy.Read.All,AuditLog.Read.All,UserAuthenticationMethod.Read.All,Directory.Read.All
Role: Global Reader or Security Reader is enough for these reads.
$p = Get-MgIdentityConditionalAccessPolicy -All
$p | Where-Object { $_.State -ne 'disabled' } | ForEach-Object { "$($_.DisplayName) | $($_.State) | excluded users: $(@($_.Conditions.Users.ExcludeUsers).Count) | excluded groups: $(@($_.Conditions.Users.ExcludeGroups).Count)" }
"Active policies with NO user or group exclusion (break-glass not excluded?): $(@($p | Where-Object { $_.State -ne 'disabled' -and -not $_.Conditions.Users.ExcludeUsers -and -not $_.Conditions.Users.ExcludeGroups }).Count)"
How to verify¶
Two emergency accounts exist with phishing-resistant credentials; every active policy that blocks or restricts excludes them; a test sign-in raised the alert within minutes.
Sources¶
This control is in the Conditional Access Baseline Kit
The free Top 5 has this control with its Jira import, Excel project plan, tracker CSV and the read-only PowerShell script. The Complete kit has all 20 controls.