Conditional Access Policies - Break Glass & Service Account(s) | Managed ISPM

Conditional Access Policies - Break Glass & Service Account(s)

Kenny Maurer

It would be great if we can specify a group or users that are excluded from managed policies (CA). For example the CIPP user should be excluded internally (if you use CIPP) and also a Break Glass Admin Account which is excluded from all policies should also be an option to set.

July 9, 2026

Anthony Duxfield

This needs to happen for the new security control "Ensure sign-in is blocked for member accounts inactive for 90 days" as well. If left to continuous enforcement it will block breakglass and service accounts as well.

Phil Jevons

Just fallen across this issue and support advised that I need to disable continuous enforcement and accept risk to be able to effectively and reliably add breakglass / emergency access account exceptions to a CAP. This seems to defeat the point of the platform as I could presumably then modify in Entra and the drift would not be picked up?

Kenny Maurer

Phil Jevons They explained to me that accept risk would just accept the risk at the time you pressed the button. Further changes would create a Ticket that you'd then need to manually resolve. But I agree, at the moment there are multiple security controls that do not work verry well for MSP's

Mark Mullarky

Agreed.

Colin Herzog

That would follow best pracitces!