Emergency access accounts
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit ea0ffc8 · +4 −4 lines · also on GitHub
⋯ 44 unchanged lines
4545
- [Register a passkey (FIDO2)](../authentication/how-to-register-passkey-with-security-key.md)
4646
- [Configure certificate-based authentication](../authentication/concept-certificate-based-authentication.md)
4747
48
−1. [Require phishing-resistant multifactor authentication](../conditional-access/policy-admin-phish-resistant-mfa.md) for all of your emergency accounts.
48
+1. Verify that emergency access accounts are excluded from any Conditional Access policy that blocks or restricts sign-in. The phishing-resistant authentication method registered in the previous step protects the account; an enforced Conditional Access policy could prevent sign-in during the exact emergency the account is designed for. Report-only policies don't block access and don't require an exclusion. For details, see [Conditional Access considerations](#conditional-access-considerations).
4949
5050
1. [Store account credentials safely](#store-account-credentials-safely).
5151
⋯ 31 unchanged lines
8383
8484
When planning your Conditional Access deployment, consider the following:
8585
86
−- Create a dedicated security group for your emergency access accounts (for example, **EmergencyAccess**) and exclude this group from all Conditional Access policies.
86
+- Create a dedicated security group for your emergency access accounts (for example, **EmergencyAccess**) and exclude this group from Conditional Access policies that block or restrict sign-in.
8787
- Regularly test (for example, every quarter) that emergency access accounts can sign in successfully with your current Conditional Access configuration.
8888
- Create contingency Conditional Access policies that can be enabled during an outage to restore access for critical users. For more information, see [Create a resilient access control management strategy](~/identity/authentication/concept-resilient-controls.md).
8989
⋯ 10 unchanged lines
100100
- In Privileged Identity Management, assign the Global Administrator role as permanent active (not eligible) for emergency accounts.
101101
- Require the use of a designated secure workstation or [Privileged Access Workstation](/security/privileged-access-workstations/privileged-access-deployment) when using emergency access accounts.
102102
- Store credentials in separate, secure, fireproof locations accessible to authorized individuals.
103
−- Exclude emergency access accounts from all Conditional Access policies.
103
+- Exclude emergency access accounts from Conditional Access policies that block or restrict sign-in. Report-only policies don't require an exclusion.
104104
- Monitor all sign-in and audit log activity for emergency access accounts with alerts to detect unnecessary or unauthorized use.
105105
- Validate account functionality at least every 90 days.
106106
⋯ 160 unchanged lines
267267
- [Plan a Privileged Identity Management deployment](~/id-governance/privileged-identity-management/pim-deployment-plan.md)
268268
- [Plan a Conditional Access deployment](~/identity/conditional-access/plan-conditional-access.md)
269269
- [HIPAA access controls](~/standards/hipaa-access-controls.md)
270
−- [Microsoft Entra and DORA act](/compliance/dora/dora-entra)
270
+- [Microsoft Entra customer considerations under DORA](/compliance/dora/dora-entra)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:17 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.