Emergency access accounts are excluded from lockout

​

What this check verifies

Microsoft Entra Conditional Access is verified to have at least one emergency access (break glass) account or group excluded from all policies. Emergency access accounts provide a fallback mechanism when normal administrative access is blocked due to misconfigured policies.

​

Risk

Without emergency access accounts excluded from Conditional Access policies, a misconfiguration could lock out all administrators from the tenant. This creates a critical availability risk where legitimate administrators cannot access or remediate issues in the environment.

​

Recommendation

Create and maintain at least two emergency access accounts that are excluded from all Conditional Access policies. Store credentials securely offline, monitor usage, and test access regularly. Follow least privilege principles for these accounts while ensuring they can recover tenant access when needed.

​

Remediation

Dashboard steps

1. Create dedicated emergency access accounts or a security group in Microsoft Entra admin center.
2. Navigate to Protection > Conditional Access > Policies.
3. For each Conditional Access policy, add the emergency access account or group to the exclusion list under Users > Exclude.
4. Ensure the emergency accounts are protected with strong credentials and limited usage.

​

References

• https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access
• https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-block-access

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_emergency_access_exclusion. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks