Emergency Access Accounts: Build, Alert and Drill

Why this lab matters

Every tenant eventually has a bad day: a Conditional Access policy that blocks all administrators, a federation outage, an MFA service problem, or the only Global Administrator leaving the company. Emergency access accounts are the planned way back in. They are powerful, so they need to be rare, protected and loud when used.

What you need

• A test tenant and the Global Administrator role.
• Two FIDO2 security keys, or one key and a certificate, so the two accounts do not share a method.
• A Log Analytics workspace receiving Entra sign-in logs, for the alert in Step 4.

Step 1: Create the accounts

1. In the Entra admin centre go to Identity, Users, All users, New user, Create new user.
2. Use the tenant's initial domain, for example ea-01@contoso.onmicrosoft.com. This keeps the account working if a custom domain or federation fails.
3. Choose a name that does not point at a person. These accounts belong to the organisation.
4. Assign the Global Administrator role as a permanent active assignment, not an eligible one.
5. Repeat for ea-02.

Confirm both are cloud-only and hold the role:

Connect-MgGraph -Scopes "User.Read.All", "RoleManagement.Read.Directory"

Get-MgUser -Filter "startswith(userPrincipalName,'ea-0')" `
  -Property UserPrincipalName, OnPremisesSyncEnabled, AccountEnabled |
  Select-Object UserPrincipalName, OnPremisesSyncEnabled, AccountEnabled

OnPremisesSyncEnabled must be empty for both accounts.

Step 2: Register phishing-resistant credentials

1. Check that Passkey (FIDO2) is enabled under Protection, Authentication methods, Policies.
2. Sign in as ea-01, open My Security info and add a security key. Give the key a PIN.
3. Repeat for ea-02 with the second key.
4. Label the keys and store them in two separate, access-controlled places. Record who can reach each one.

Step 3: Exclude the accounts from Conditional Access

1. Create a security group named GRP-EmergencyAccess and add both accounts.
2. Edit each Conditional Access policy and add the group under Users, Exclude.
3. Consider leaving one account excluded from every policy and letting the second be covered by a policy that requires phishing-resistant MFA only. That gives you one account that survives any policy mistake.

List policies that still do not exclude the group:

Connect-MgGraph -Scopes "Policy.Read.All", "Group.Read.All"

$grp = Get-MgGroup -Filter "displayName eq 'GRP-EmergencyAccess'"
Get-MgIdentityConditionalAccessPolicy -All |
  Where-Object { $_.Conditions.Users.ExcludeGroups -notcontains $grp.Id } |
  Select-Object DisplayName, State

Step 4: Alert on every sign-in

In your Log Analytics workspace, create an alert rule with this query. It should fire on any result, including failures.

SigninLogs
| where UserPrincipalName in~ ("ea-01@contoso.onmicrosoft.com", "ea-02@contoso.onmicrosoft.com")
| project TimeGenerated, UserPrincipalName, ResultType, IPAddress, AppDisplayName, Location

1. Select New alert rule from the query.
2. Measure: table rows. Threshold: greater than 0. Evaluate every 5 minutes.
3. Send it to an action group that reaches the security team by email and SMS or a chat channel. Set the severity to the highest level you use.

Step 5: Run the drill

1. Start a timer. Ask a colleague who has not done this before to retrieve one key, following only the written procedure.
2. Sign in to the Entra admin centre as that account and open Conditional Access.
3. Confirm the alert arrived and note how long it took.
4. Sign out, return the key and record the drill: date, who took part, time to sign in, time to alert, and anything that was unclear.

Evidence to keep

• The account list showing cloud-only status and the Global Administrator assignment.
• The output proving every Conditional Access policy excludes the group.
• The alert rule definition and a copy of the alert from the drill.
• The drill record, signed off by the account owner.

Clean up

In a test tenant, delete both accounts, the group and the alert rule. In a real tenant keep them, review them every quarter and repeat the drill at least twice a year and after any change in admin staff.