MT.1034 - Emergency access users should not be blocked.

Contributed by Merill Fernando with 3 co-contributorsAll contributors →

Overview

Emergency access (break-glass) accounts must stay usable when everything else fails, so Conditional Access policies should not block them.

Maester finds up to five emergency access accounts (the users or group most often excluded from Conditional Access policies) and evaluates a sign-in for each with the Conditional Access What If API. One result is created per account (MT.1034.<n>). The check fails when any policy applies to the account.

Learn more:

• Manage emergency access accounts in Microsoft Entra ID
• Conditional Access What If tool

Remediation action

Exclude your emergency access accounts from the Conditional Access policies that apply to them.

Test Metadata

Field	Value
Test ID	MT.1034
Severity	High
Suite	Maester
Product	Entra ID
Feature	Conditional Access
Area	Privileged access
Resource type	User
User impact	Low
Implementation cost	Low
MITRE ATT&CK	None
PowerShell test	Test-MtCaWhatIfEmergencyAccessNotBlocked
Services	Graph
Compatible licenses	AAD_PREMIUM
Runs per instance	Yes, one result per instance from Get-MtCaWhatIfEmergencyAccessInstance
Long running	Yes

Source

• Test: tests/maester/entra/Test.MT.1034.ps1
• Documentation: tests/maester/entra/Test.MT.1034.md