# Conditional Access: never lock the tenant without a door Source: https://ai.techclick.in/blog_azure_conditional_access_break_glass Markdown: https://ai.techclick.in/blog_azure_conditional_access_break_glass.md Publisher: Techclick Infosec Pvt Ltd CA MFA for admins. Break-glass bg-emergency excluded and monitored. Report-only first. Do not lock the tenant. ## The ticket All Global Admins are stuck on an MFA loop. CA includes All users, All cloud apps, Grant: MFA + compliant device. The intern’s laptop is not compliant. There is no excluded emergency account. You are now locked out of techclick-lab.in . Quick interview answer Conditional Access is Entra’s policy engine: assignments (users/groups/roles), target resources, conditions (device, location, risk), grant (MFA, compliant device), session. Ship new policies in report-only , read the What If / sign-in insights, then On. Keep at least one cloud-only emergency (break-glass) account excluded from CA, with a long secret, stored offline, and alerted on every sign-in. Do not use it as a daily admin. Do not exclude “all admins” — exclude the emergency object only. Hero · locked door Report-only is a dress rehearsal. Break-glass is the spare key, not the front door. Lab data · dummy only Tenant techclick-lab.in · MG tc-root / tc-landing / tc-workloads · subs sub-hub sub-spoke-app · hub VNet 10.40.0.0/16 · spoke 10.41.0.0/16 · Azure Firewall 10.40.0.4 · VPN GW public 203.0.113.50 · on-prem FortiGate WAN 203.0.113.10 . Not a live tenant. ## Mental model Object Job This lab CA policy If this identity + app + condition → grant CA-Admin-MFA Report-only Evaluate, do not enforce First 7 days of a new policy Break-glass Cloud-only, excluded, monitored bg-emergency@techclick-lab.in What If Simulate a sign-in Before you flip On Who is in the policy - Directory roles MFA + report-only → On Named locations optional condition bg-emergency excluded + alerted Exclude the emergency account. Monitor it. Do not exclude the Global Admin role. ## How to choose Policy Use Trap MFA for directory roles This class + any prod tenant Also targeting bg-emergency All users / all apps / compliant device After report-only + device estate is real Day-one On Block legacy auth Yes, after you find the printer that still uses it Blind On, then Exchange dies https://portal.azure.com Training mock · not live Azure portal Home Microsoft Entra ID Virtual networks Azure Firewall Microsoft Entra ID → Protection → Conditional Access ### CA-Admin-MFA State Report-only Users Directory roles: Global Admin, Security Admin Exclude bg-emergency@techclick-lab.in Grant Require multifactor authentication Break-glass monitor Alert on any sign-in for bg-emergency Cancel Save Report-only first. Exclude only the emergency account. Training mock. ## Runbook #### Side A — spare key Create cloud-only bg-emergency . Long password in the offline safe. No MFA device that can be lost with the rest. Exclude from every CA policy. Do not assign standing daily work to it. - #### Side B — policy New CA: directory roles → MFA. State = report-only. What If Priya (admin) and What If bg-emergency (must not apply). - #### Side C — prove Sign-in log: result = report-only. Alert rule on bg-emergency . Then flip On. Keep a second person who can reach the safe. az · dummy az ad user show --id bg-emergency@techclick-lab.in --query userPrincipalName -o tsv # bg-emergency@techclick-lab.in az rest --method GET --url "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" --query "value[].displayName" -o tsv # CA-Admin-MFA # CA-Block-Legacy # Portal: Entra → Sign-in logs → filter user bg-emergency # Expected day-to-day: zero rows. Any row = incident. ## Four failures ### 1 · CA includes break-glass You built a lock and hid the key inside the house that just locked. ### 2 · On without report-only Automation, guest, or a legacy protocol dies at 02:00. ### 3 · Break-glass used as daily admin Then it gets MFA “like everyone else.” Then you have no emergency. ### 4 · No monitor An excluded account with Global Admin and no alert is a gift to an attacker. ## How to prove it Close only when 1) What If shows MFA for admins and skip for bg-emergency. 2) Report-only insights exist. 3) An alert exists for that UPN. 4) You did not flip All users / All apps / On in one click. ## Traps Move Result Exclude the Global Admin role No admin is covered — attackers love this Share bg-emergency password in Teams It is no longer break-glass Sync break-glass from on-prem AD Now on-prem outage locks Azure too ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Before enforcing a new CA policy… Set it On for All users Run it report-only and read sign-in insights / What If Disable Entra Delete bg-emergency Correct: b . Report-only first. Q2 bg-emergency should be… Included in every CA policy Excluded from CA, cloud-only, and alerted on every sign-in The daily Global Admin Synced from on-prem AD Correct: b . Break-glass design. Q3 You locked every Global Admin out. First designed recovery? Factory-reset the tenant Use the excluded break-glass account, then fix CA Open NSG any-any Disable Azure Firewall Correct: b . That is why it exists. Q4 Excluding the Global Admin role from CA is bad because… Admins then have no CA control It enables WAF It deletes subscriptions It renames GatewaySubnet Correct: a . Trap. Q5 Conditional Access lives in… An NSG Microsoft Entra ID Azure Firewall application rules Key Vault access policies Correct: b . Entra policy engine. Q6 A sign-in log row for bg-emergency on a quiet Tuesday means… Healthy heartbeat Treat as an incident until proven otherwise CA is off PIM is required to read logs Correct: b . Failure 4. Check answers Reset Azure security class series: Shared + Entra · Landing zone · NSG vs Firewall vs WAF · Conditional Access · Key Vault + MI · Private Link · Defender + Sentinel · Hub-spoke · Identity path · Interview ## Sources - Microsoft Learn — What is Conditional Access? . Related: Azure session factory · Migration series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt