Detections
Analytics

1.1.2 (L1) Ensure two emergency access accounts have been defined

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Emergency access or "break glass" accounts are limited for emergency scenarios where normal administrative accounts are unavailable. They are not assigned to a specific user and will have a combination of physical and technical controls to prevent them from being accessed outside a true emergency. These emergencies could be due to several things, including:

 - Technical failures of a cellular provider or Microsoft related service such as MFA.
 - The last remaining Global Administrator account is inaccessible.

Ensure two Emergency Access accounts have been defined.

Note: Microsoft provides several recommendations for these accounts and how to configure them. For more information on this, please refer to the references section. The CIS Benchmark outlines the more critical things to consider.

In various situations, an organization may require the use of a break glass account to gain emergency access. In the event of losing access to administrative functions, an organization may experience a significant loss in its ability to provide support, lose insight into its security posture, and potentially suffer financial losses.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

To remediate using the UI:

Step 1 - Create two emergency access accounts:

 - Navigate to Microsoft 365 admin center https://admin.microsoft.com
 - Expand Users > Active Users
 - Click Add user and create a new user with this criteria:
 - Name the account in a way that does NOT identify it with a particular person.
 - Assign the account to the default .onmicrosoft.com domain and not the organization's.
 - The password must be at least 16 characters and generated randomly.
 - Do not assign a license.
 - Assign the user the Global Administrator role.

 - Repeat the above steps for the second account.

Step 2 - Exclude at least one account from conditional access policies:

 - Navigate Microsoft Entra admin center https://entra.microsoft.com/
 - Expand Protection > Conditional Access.
 - Inspect the conditional access policies.
 - For each rule add an exclusion for at least one of the emergency access accounts.
 - Users > Exclude > Users and groups and select one emergency access account.

Step 3 - Ensure the necessary procedures and policies are in place:

 - In order for accounts to be effectively used in a break glass situation the proper policies and procedures must be authorized and distributed by senior management.
 - FIDO2 Security Keys should be locked in a secure separate fireproof location.
 - Passwords should be at least 16 characters, randomly generated and MAY be separated in multiple pieces to be joined on emergency.

Warning: As of 10/15/2024 MFA is required for all users including Break Glass Accounts. It is recommended to update these accounts to use passkey (FIDO2) or configure certificate-based authentication for MFA. Both methods satisfy the MFA requirement.

Additional suggestions for emergency account management:

 - Create access reviews for these users.
 - Exclude users from conditional access rules.
 - Add the account to a restricted management administrative unit.

Warning : If CA (conditional access) exclusion is managed by a group, this group should be added to PIM for groups (licensing required) or be created as a role-assignable group. If it is a regular security group, then users with the Group Administrators role are able to bypass CA entirely.

Impact:

Failure to properly implement emergency access accounts can weaken the security posture. Microsoft recommends excluding at least one of the two emergency access accounts from all conditional access rules, necessitating passwords with sufficient entropy and length to protect against random guesses. For a secure passwordless solution, FIDO2 security keys may be used instead of passwords.

See Also

https://workbench.cisecurity.org/benchmarks/22162

Item Details

Plugin: microsoft_azure

Control ID: 283470883f441933b857b4ce270f64100e0ecd0d8f3593791de6417de68d5360