Question

You are deploying a Conditional Access policy that requires multifactor authentication for all users when accessing any cloud app. Your security team is concerned that a misconfiguration or MFA service outage could lock all administrators out of the tenant. Following Microsoft's recommended practices, what should you do before enabling the policy?

Accepted Answer

Exclude two cloud-only emergency access (break-glass) accounts from the policy and monitor their sign-ins with alerts

Answer

Enable the policy in report-only mode permanently so it never enforces MFA

Answer

Assign the Global Administrator role to a synchronized on-premises account and exclude it from all policies

Answer

Configure per-user MFA for all administrators instead of using Conditional Access