Emergency Administrator Accounts — MFA Exclusion
2 emergency administrator accounts remain excluded from MFA.
Should the MFA exclusion be granted, time-boxed, or denied?
Two break-glass administrator accounts are excluded from MFA to preserve emergency access. This is an open High finding against a mandatory control and blocks authorisation until reviewed with a compensating control and bounded expiry.
1 High
Open finding
1
Authorisation dependency
- Direct observation
Entra ID conditional access
2 accounts excluded from MFA policy
- Source
- Entra ID Configuration
- Timestamp
- Observed 10:54
- Method
- Machine observed
- Confidence
- High
Grant time-boxed exception with compensating control
MEDIUM confidenceEmergency access must be preserved, but the exclusion should be bounded and monitored rather than standing.
A recommendation only. It is not an approval. The accountable human below remains responsible for the decision.
Requires Treatment & Exceptions authority (System Owner). Acting as System Owner in this demonstration.
- Security Architect
May validate system-model assertions and architecture conflicts.
- Security Assessor
May determine control effectiveness.
- System OwnerRequired
May approve treatments and operational exceptions within delegated authority.
- Risk Owner
May accept residual risk within delegated authority.
- Authorising Officer
May authorise system operation.
Authority is not transferable by discovery. A Security Architect cannot accept residual organisational risk merely because they identified it, and a Security Assessor cannot issue system authorisation.
- 3 days agoFinding raised — MFA exclusion
- 2 days agoAssigned to System Owner