The ticket
All Global Admins are stuck on an MFA loop. CA includes All users, All cloud apps, Grant: MFA + compliant device. The intern’s laptop is not compliant. There is no excluded emergency account. You are now locked out of techclick-lab.in.
Conditional Access is Entra’s policy engine: assignments (users/groups/roles), target resources, conditions (device, location, risk), grant (MFA, compliant device), session. Ship new policies in report-only, read the What If / sign-in insights, then On. Keep at least one cloud-only emergency (break-glass) account excluded from CA, with a long secret, stored offline, and alerted on every sign-in. Do not use it as a daily admin. Do not exclude “all admins” — exclude the emergency object only.
Tenant techclick-lab.in · MG tc-root / tc-landing / tc-workloads · subs sub-hub sub-spoke-app · hub VNet 10.40.0.0/16 · spoke 10.41.0.0/16 · Azure Firewall 10.40.0.4 · VPN GW public 203.0.113.50 · on-prem FortiGate WAN 203.0.113.10. Not a live tenant.
Mental model
| Object | Job | This lab |
|---|---|---|
| CA policy | If this identity + app + condition → grant | CA-Admin-MFA |
| Report-only | Evaluate, do not enforce | First 7 days of a new policy |
| Break-glass | Cloud-only, excluded, monitored | bg-emergency@techclick-lab.in |
| What If | Simulate a sign-in | Before you flip On |
Exclude the emergency account. Monitor it. Do not exclude the Global Admin role.
How to choose
| Policy | Use | Trap |
|---|---|---|
| MFA for directory roles | This class + any prod tenant | Also targeting bg-emergency |
| All users / all apps / compliant device | After report-only + device estate is real | Day-one On |
| Block legacy auth | Yes, after you find the printer that still uses it | Blind On, then Exchange dies |
CA-Admin-MFA
Runbook
Side A — spare key
Create cloud-only
bg-emergency. Long password in the offline safe. No MFA device that can be lost with the rest. Exclude from every CA policy. Do not assign standing daily work to it.Side B — policy
New CA: directory roles → MFA. State = report-only. What If Priya (admin) and What If
bg-emergency(must not apply).Side C — prove
Sign-in log: result = report-only. Alert rule on
bg-emergency. Then flip On. Keep a second person who can reach the safe.
az ad user show --id bg-emergency@techclick-lab.in --query userPrincipalName -o tsv # bg-emergency@techclick-lab.in az rest --method GET --url "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" --query "value[].displayName" -o tsv # CA-Admin-MFA # CA-Block-Legacy # Portal: Entra → Sign-in logs → filter user bg-emergency # Expected day-to-day: zero rows. Any row = incident.
Four failures
1 · CA includes break-glass
You built a lock and hid the key inside the house that just locked.
2 · On without report-only
Automation, guest, or a legacy protocol dies at 02:00.
3 · Break-glass used as daily admin
Then it gets MFA “like everyone else.” Then you have no emergency.
4 · No monitor
An excluded account with Global Admin and no alert is a gift to an attacker.
How to prove it
1) What If shows MFA for admins and skip for bg-emergency. 2) Report-only insights exist. 3) An alert exists for that UPN. 4) You did not flip All users / All apps / On in one click.
Traps
| Move | Result |
|---|---|
| Exclude the Global Admin role | No admin is covered — attackers love this |
| Share bg-emergency password in Teams | It is no longer break-glass |
| Sync break-glass from on-prem AD | Now on-prem outage locks Azure too |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
Azure security class series: Shared + Entra · Landing zone · NSG vs Firewall vs WAF · Conditional Access · Key Vault + MI · Private Link · Defender + Sentinel · Hub-spoke · Identity path · Interview
Sources
Related: Azure session factory · Migration series.