All Conditional Access policies are configured to exclude at least one emergency/break glass account or group

Contributed by Fabian Bader with 4 co-contributorsAll contributors →

Part of Maester · Entra ID · Conditional Access · All checks

Run this check

Invoke-Maester -TestId MT.1005

Overview

It is recommended to have at least one emergency/break glass account or account group excluded from all Conditional Access policies. This allows for emergency access to the tenant in case of a misconfiguration or other issues.

See Manage emergency access accounts in Microsoft Entra ID - Microsoft Learn

Details

Every attribute of this check

Field	Value
Test ID	MT.1005
Severity	High
Suite	Maester
Product	Entra ID
Feature	Conditional Access
Area	Privileged access
Resource type	ConditionalAccessPolicy
User impact	Low
Implementation cost	Low
MITRE ATT&CK	None
PowerShell test	Test-MtCaEmergencyAccessExists
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/maester/entra/Test.MT.1005.ps1
• Documentation: tests/maester/entra/Test.MT.1005.md