Detections
Analytics

2.2.1 (L1) Ensure emergency access account activity is monitored

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Organizations should monitor sign-in and audit log activity from the emergency accounts and trigger notifications to other administrators. When you monitor the activity for emergency access accounts, you can verify these accounts are only used for testing or actual emergencies. You can use Azure Monitor, Microsoft Sentinel, Defender for Cloud Apps or other tools to monitor the sign-in logs and trigger email and SMS alerts to your administrators whenever emergency access accounts sign in.

This recommendation uses Defender for Cloud Apps Policies to alert on emergency access account activity.

The recommended state is to monitor Activity type Log on on break-glass or emergency access accounts.

Emergency access accounts should be used in very few scenarios, for example, the last Global Administrator has left the organization and the account is inaccessible. All activity on an emergency access account should be reviewed at the time of the event to ensure the sign on is legitimate and authorized.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

To remediate using the UI:

 - Navigate to Microsoft 365 Defender https://security.microsoft.com
 - Under the Cloud Apps section select Policies -> Policy management.
 - Click on All policies and then Create policy -> Activity policy.
 - Give the policy a name and set the following:
 - Policy severity to High severity.
 - Category to Privileged accounts.
 - Act on Single activity.
 - Click Select a filter -> Activity type equals Log on.
 - Click Add a filter -> User Name equals <Emergency access account> as Any role.
 - Ensure all emergency access accounts are added to this policy or another.
 - Select an alert method such as Send alert as email.

 Note: Multiple accounts can be monitored by a single policy or by separate policies.

Impact:

There is no real world impact to monitoring these accounts beyond allocating staff. The frequency of emergency account sign on should be so low that any activity raises a red flag that is treated with the highest priority.

See Also

https://workbench.cisecurity.org/benchmarks/24619

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, CSCv7|16

Plugin: microsoft_azure

Control ID: 5f0454288610a4572a61cf66ffb5c0815a1df4b60045bd94a0bf6ee3bf78ee4c