MT.1191 - Break-glass accounts should be excluded from the Compliant Network Conditional Access policy.
Overview
A Conditional Access policy that enforces the Global Secure Access Compliant Network control blocks access when the session is not on a compliant network. If such a policy does not exclude the emergency access (break-glass) accounts, it can lock out the very accounts needed to recover the tenant during an outage or misconfiguration.
Every Compliant Network enforcement policy must therefore exclude all break-glass accounts - either directly, or via a group they belong to (nested group membership is honored, as Conditional Access evaluates it). Emergency access accounts are read from the EmergencyAccessAccounts setting in maester-config.json.
Remediation action
- Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
- Browse to Entra ID > Conditional Access > Policies and open each flagged policy.
- Under Assignments > Users > Exclude, add the emergency access accounts or the break-glass group.
Related links
- Manage emergency access accounts in Microsoft Entra ID
- Enable compliant network check with Conditional Access
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1191 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Global Secure Access |
| Area | Privileged access |
| Resource type | ConditionalAccessPolicy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtGsaCompliantNetworkBreakGlassExcluded |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
| Lifecycle | Preview |