MT.1005 - All Conditional Access policies are configured to exclude at least one emergency/break glass account or group.
Overview
It is recommended to have at least one emergency/break glass account or account group excluded from all Conditional Access policies. This allows for emergency access to the tenant in case of a misconfiguration or other issues.
See Manage emergency access accounts in Microsoft Entra ID - Microsoft Learn
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1005 |
| Severity | High |
| Suite | Maester |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Privileged access |
| Resource type | ConditionalAccessPolicy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtCaEmergencyAccessExists |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/maester/entra/Test.MT.1005.ps1 - Documentation:
tests/maester/entra/Test.MT.1005.md