Entra ID Conditional Access Device Compliance Lockout

Question

Hi all,

A new Conditional Access policy requiring compliant devices is locking out IT admins using non-domain-joined jump boxes.

How can we use break-glass accounts and PowerShell to exclude emergency access accounts from Conditional Access?

Tysm, Farid

Answer 1

Hello Farid,

Thank you for posting question on Microsoft Windows Forum!

Well! It is recommended that emergency access / break-glass accounts be excluded from Conditional Access policies that could otherwise prevent sign-in, including policies requiring a compliant device. This is specifically intended to prevent a tenant-wide lockout when administrators are using an unmanaged/non-domain-joined jump box. The best practice is to have at least two break-glass accounts, monitored and protected, but excluded from CA enforcement.

Based on this scenario. You can try this by going to Azure AD portal → Security → Conditional Access → Policies. Edit the policy requiring compliant devices. Under Assignments → Users and groups: Include All users. Under Exclude, select your break-glass accounts. This will ensure those accounts are not blocked by the compliant-device requirement.

Please note: if a break-glass account itself is subject to requirements such as MFA, device compliance, or another access control, it may become unusable when it is actually needed.

You can refer to the following articles for further reference.

• https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access
• https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-device-compliance
• https://learn.microsoft.com/en-us/powershell/module/microsoft.entra.signins/new-entraconditionalaccesspolicy

Hope the above information is helpful!