MT.1191 - Break-glass accounts should be excluded from the Compliant Network Conditional Access policy
Overview
A Conditional Access policy that enforces the Global Secure Access Compliant Network control blocks access when the session is not on a compliant network. If such a policy does not exclude the emergency access (break-glass) accounts, it can lock out the very accounts needed to recover the tenant during an outage or misconfiguration.
Every Compliant Network enforcement policy must therefore exclude all break-glass accounts - either directly, or via a group they belong to (nested group membership is honored, as Conditional Access evaluates it). Emergency access accounts are read from the EmergencyAccessAccounts setting in maester-config.json.
Remediation action:
- Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
- Browse to Entra ID > Conditional Access > Policies and open each flagged policy.
- Under Assignments > Users > Exclude, add the emergency access accounts or the break-glass group.
Related links
- Manage emergency access accounts in Microsoft Entra ID
- Enable compliant network check with Conditional Access
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1191 |
| Severity | Unknown |
| Suite | Maester |
| Category | Entra |
| PowerShell test | Test-MtGsaCompliantNetworkBreakGlassExcluded |
| Tags | CA, Entra, Maester, MT.1191, Preview |
Source
- Pester test:
tests/Maester/GlobalSecureAccess/Test-MtGsaCompliantNetworkBreakGlassExcluded.Tests.ps1 - PowerShell source:
powershell/public/maester/globalsecureaccess/Test-MtGsaCompliantNetworkBreakGlassExcluded.ps1