Question

Your organization is deploying Privileged Identity Management (PIM) for the Global Administrator role and enforcing a Conditional Access policy that requires phishing-resistant MFA for all administrators. Security policy also requires two break-glass (emergency access) accounts that must remain usable if PIM, MFA infrastructure, or federation fails. You must configure the break-glass accounts to comply with Microsoft's recommended practices while still maintaining oversight. Which configuration should you implement?

Accepted Answer

Assign the Global Administrator role to the break-glass accounts as permanent active (not eligible) assignments, exclude them from all Conditional Access policies, and create a Log Analytics alert on their sign-ins.

Answer

Make the break-glass accounts eligible for Global Administrator in PIM with approval required, and exclude them from MFA Conditional Access policies.

Answer

Assign the break-glass accounts permanent active Global Administrator, enroll them in phishing-resistant MFA, and include them in all Conditional Access policies for consistency.

Answer

Configure the break-glass accounts as PIM-eligible with a 24-hour activation window and exclude them from the sign-in frequency policy only.