Conditional Access MFA for Admin Policy

Question

Conditional Access MFA for Admin Policy

Anonymous

I have 2 Global AAD accounts, for the sake of this exercise call them Account1 and Account 2.

Account1 is my main Global Admin work account.
Account2 is my Break Glass account.
I have MFA set up on Account1, but don't have MFA set up on Account 2.

I have set up Conditional Access Policy for account Assignments:

Account1 Included
Account 2 Excluded

I then set Grant Access to MFA.

Now my expectation is MFA will be asked for when SSO with Account1, but with Account2, SSO will just ask for the password and not follow up with MFA.

Is this correct?

I haven't yet tested it out as yet, because I am 'leery' that I might lock myself out of all Global Admin Accounts.

To ere on the safe side, I have added a third Global Admin Account3

Accepted answer

2 additional answers

Your answer

Answer 1

@Anonymous

I would recommend all users including global admins in your tenant to register for MFA even though they are not prompted for MFA. This will ensure that you are not blocked to access the Azure AD portal even if MFA is enforced through conditional access policy.

In your scenario there are 2 accounts. If you want to MFA to be prompted only for account 1.
In this scenario while configuring MFA, you can include only the user accounts to whom MFA needs to be prompted.

If you have multiple groups of accounts and if you want to exclude only one account from the group, then you can use the exclude option which configuring conditional access policy.

After creating the policy, you can use whatif tool to confirm what all policies are getting applied to specific account.
Refer below article to know more about what if tool,
https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/troubleshoot-conditional-access-what-if

This way you can create a policy and run what if tool against one admin account and confirm regarding MFA prompt.

Do let me know if you have any further questions on this

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Anonymous

2022-11-24T17:56:03.697+00:00

@Sanddep G-MSFT
I have already got a grant access MFA Conditional Access Policy for All Users set Up. I have excluded Account 2 from this policy.

I have also set up a grant access MFA Conditional Access Policy for All Global Administrators, Include Account1, Exclude Account2.

Couple of supplemental questions.

Account2 has not licence attached to it, does this exclude it from the MFA process by default or because it's a global administrator does it have access to the MFA process by right?

By excluding Account2 from, grant access MFA Conditional Access Policy for All Global Administrators, is that in effect explicitly BLOCKING the account from the MFA Registration process?

What would happen if I didn't exclude Account2 in the conditional access policy above in point 2, but then set up a Block Access Conditional Access Policy for Global Administrators for just Account2 inclusion? Which conditional access policy take precedence? the Grant Access Policy or the Block Access Policy?

List item

Answer 2

Hi @Anonymous

If you exclude Account2 from a Conditional Access Policy then it will not be affected by the change. From my understanding you are trying to force MFA to all accounts (Account1 included, but Account2 excluded). If you follow proper procedures for excluding Account2 you will be set.

It even states in the documentation to exclude one Administrator account so you don't lock yourself out:

https://learn.microsoft.com/en-us/azure/active-directory/governance/conditional-access-exclusion#create-a-conditional-access-policy-that-excludes-the-group

----------------------------------

If this is helpful please accept answer.

Answer 3

Anonymous

Will do and many thanks for your support.

Share via

Conditional Access MFA for Admin Policy

2 additional answers

Your answer