What it decides

Rule
CA-RECOVERY-001
Applies to
entra · conditional-access-policy
Default severity
high
Basis
documented-guidance

On what authority

Microsoft recommends excluding "emergency access or break-glass accounts to prevent lockout due to policy misconfiguration", and states what they are for: "In the unlikely scenario where all administrators are locked out, your emergency access administrative account can be used to sign in and recover access." It is guidance rather than a requirement, and an organisation may decline it: a tenant with a documented recovery path that does not depend on a Conditional Access exclusion is answering the same question a different way. What this rule refuses is the case where nobody answered it at all, which looks identical in the portal to the case where somebody did. It reads the policy that would cause the lockout rather than looking for an account somewhere else, because an exclusion that is not on this policy does not help during this policy's failure.

What it needs to decide

  • conditional_access_policies.included_users
  • conditional_access_policies.exclusions_declared

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

  • conditional-access: the Conditional Access policies, named locations and Security Defaults state of one tenant · provider live-validated, slice not live-validated

What a pass does not establish

AN EXCLUSION IS NOT A RECOVERY PATH. This rule reads whether anything is excluded, and it cannot read whether what was excluded is an emergency access account, whether that account works, whether anybody knows its credentials, or whether it is itself protected. A policy excluding one disabled account passes this rule and helps nobody.

  • A tenant may be recoverable without any exclusion here: through another administrator not covered by this policy's conditions, through a different authentication method that still satisfies it, or through a support process the organisation has rehearsed. None of those is visible from this policy.
  • This reads one policy. Two policies that each exclude somebody can still lock out every administrator between them, and no rule here answers that.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b8@c2aecc628b21.

Generated from capability-manifest/1.0.0 at 1.0.0b8@c2aecc628b21, contract 1.0.0b8. Every fact on this page is the Engine's; this site publishes it and does not maintain it.