Conditional Access Policies - Break Glass & Service Account(s)
A
Anthony Duxfield
This needs to happen for the new security control "Ensure sign-in is blocked for member accounts inactive for 90 days" as well. If left to continuous enforcement it will block breakglass and service accounts as well.
M
Mohammad Tazeem Naz
I second this, along with adding an exception to "Ensure sign-in to shared mailboxes is blocked."
One use case is an unlicensed Global Administrator account maintained as a break-glass/highest-privilege account and not intended for day-to-day use.
Since Microsoft sends certain tenant and security notifications directly to administrator accounts, I create the account as a shared mailbox and delegated mailbox access to the normal day-to-day account. This allows to monitor messages sent to the administrator account without routinely signing in with the privileged identity.
While individual Microsoft services may allow alternate notification recipients to be configured, these settings are service-specific and may not cover every tenant-level notification.
Unless I am missing to see a better way for handling this
P
Phil Jevons
Just fallen across this issue and support advised that I need to disable continuous enforcement and accept risk to be able to effectively and reliably add breakglass / emergency access account exceptions to a CAP. This seems to defeat the point of the platform as I could presumably then modify in Entra and the drift would not be picked up?
K
Kenny Maurer
Phil Jevons They explained to me that accept risk would just accept the risk at the time you pressed the button. Further changes would create a Ticket that you'd then need to manually resolve. But I agree, at the moment there are multiple security controls that do not work verry well for MSP's
M
Mark Mullarky
Agreed.
C
Colin Herzog
That would follow best pracitces!