As of July 2024, Microsoft has started introducing new security measures at the tenant level that mandate multifactor authentication (MFA) for all users who access certain sensitive resources, such as the Azure portal or Entra admin center. These changes will take effect in a phased approach and are documented by Microsoft on Microsoft Learn.

Security Default Change Enforcement Timeline

This security measure is an excellent step forward by Microsoft in ensuring the security of all M365 and Azure customers. This does, however, come with the risk of certain accounts such as emergency access aka “break-glass” accounts not functioning if authentication methods for these accounts are not updated to meet the criteria of the new security defaults.

It is strongly recommended that emergency access accounts (EAAs) be updated to use FIDO2 or certificate-based authentication as an MFA factor to satisfy the new tenant-level security measures, in addition to complex passwords.

A Common Misunderstanding About MFA on Admin Accounts

One of the most common misunderstandings that I have encountered from some of our clients who use Entra ID and M365 stems from a misunderstanding of Microsoft’s documentation for EAAs. In the documentation, it is advised to “exclude at least one account from conditional access policies.”

The intention of this guidance is to ensure that organizations have a dedicated EAA single-factor admin account with a unique and complex password written down somewhere secure, which are only used for emergencies (i.e., as an MFA or federation services outage, or some other outage or disaster that would prevent admins from authenticating). Some have misinterpreted this to mean that all global admins should be excluded from MFA. This misunderstanding has led to security incidents where an admin was compromised, MFA was not enforced and it then became incredibly trivial for the TA to do nearly whatever they want in the customer’s tenant, as they were now a global admin. Previously, it was recommended that only EAAs be excluded from MFA, and that those accounts would be never used and monitored for suspicious login events. The new guidance is to ensure that EAAs have FIDO2 or certificate-based authentication enabled as an MFA factor and to no longer exclude any admin account from MFA for any reason.

Updated Best Practices for Emergency Access Accounts

It is important to secure EAAs with strong authentication methods. The best current practices from Microsoft’s documentation are available on Microsoft Learn. it is very important for organizations who rely on Microsoft 365 or Azure services take the following measures to ensure that they meet best current practices and are never locked out of their tenant in an emergency: