Conditional Access Policies - Break Glass & Service Account(s) | Voters

Conditional Access Policies - Break Glass & Service Account(s)

Kenny Maurer

It would be great if we can specify a group or users that are excluded from managed policies (CA). For example the CIPP user should be excluded internally (if you use CIPP) and also a Break Glass Admin Account which is excluded from all policies should also be an option to set.

July 9, 2026

Phil Jevons

Just fallen across this issue and support advised that I need to disable continuous enforcement and accept risk to be able to effectively and reliably add breakglass / emergency access account exceptions to a CAP. This seems to defeat the point of the platform as I could presumably then modify in Entra and the drift would not be picked up?

Mark Mullarky

Agreed.

Colin Herzog

That would follow best pracitces!