TenantLens

1.3.2

Rules/CA-005.break-glass-excluded.psd1

@{
    Id          = 'CA-005'
    Title       = 'A break-glass account is excluded from every enabled policy'
    Area        = 'ConditionalAccess'
    Severity    = 'High'
    References  = @(
        'https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access'
    )
    Rationale   = 'Without an emergency-access account excluded from all Conditional Access policies, a single misconfigured policy (or an MFA outage) can lock every administrator out of the tenant.'
    Remediation = 'Create at least one cloud-only emergency-access account with a strong credential, exclude it from every Conditional Access policy and monitor its sign-ins.'
    Test        = {
        param($Snapshot)
        $enabled = @($Snapshot.ConditionalAccess | Where-Object { $_.state -eq 'enabled' })
        if ($enabled.Count -eq 0) {
            return New-TLRuleResult -Status Manual -Evidence 'No enabled Conditional Access policies - nothing to exclude a break-glass account from.'
        }
        $common = $null
        foreach ($policy in $enabled) {
            $excluded = @()
            if ($policy.conditions -and $policy.conditions.users) { $excluded = @($policy.conditions.users.excludeUsers) }
            if ($null -eq $common) { $common = $excluded }
            else { $common = @($common | Where-Object { $excluded -contains $_ }) }
        }
        $common = @($common | Where-Object { $_ })
        if ($common.Count -gt 0) {
            New-TLRuleResult -Status Pass -Evidence ("{0} account(s) are excluded from all {1} enabled policies." -f $common.Count, $enabled.Count)
        }
        else {
            New-TLRuleResult -Status Fail -Evidence 'No single account is excluded from every enabled Conditional Access policy.'
        }
    }
}