🛡️ Azure Emergency Access Account resource recovery is not established🟢⚪

• Contextual name: 🛡️ Emergency Access Account resource recovery is not established🟢⚪
• ID: /ce/ca/azure/microsoft-entra-id/emergency-access-resource-recovery
• Tags:
  • ⚪ Impossible policy
  • 🟢 Policy with categories
  • 🟢 Policy with type
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Description

Open File

Description

Microsoft Entra ID roles grant no Azure RBAC, so a tenant can lose all ability to manage its subscriptions while Global Administrators remain. A Global Administrator restores access by setting Access management for Azure resources to Yes, which grants root-scope access. Maintain emergency access accounts (aka "break-glass accounts") and a tested recovery procedure.

Rationale

Because Entra ID and Azure RBAC are secured separately, a tenant can reach a state where no account holds Owner or User Access Administrator at any scope, after the last privileged account leaves or root-scope access is removed for least privilege. If no Global Administrator can sign in, no one can elevate access, and recovery depends on Microsoft support.

Audit

This requirement needs manual assessment. Emergency-account designation and a tested resource-access recovery procedure require organizational review.

Remediation

Open File

Remediation

Microsoft Entra ID roles grant no Azure RBAC, so a tenant can lose all ability to manage its subscriptions while Global Administrators remain. A Global Administrator restores access by setting Access management for Azure resources to Yes, which grants root-scope access. Maintain emergency access accounts (aka "break-glass accounts") and a tested recovery procedure.

Maintain at least two cloud-only emergency access accounts with active, permanent Global Administrator assignments. Protect their credentials under dual control, monitor every sign-in, and exclude the accounts from Conditional Access policies that could block emergency sign-in.

Document and test resource-access recovery at least every 90 days. During recovery, temporarily enable Access management for Azure resources, sign out and back in, and grant Owner only at the subscription or non-root management group being recovered. Restore normal access, set Access management for Azure resources back to No to remove the temporary root-scope elevation, and sign out.

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v7.0.0 → 💼 5.10 Ensure Emergency Access Accounts Can Regain Azure Resource Access (Manual)			1		no data
💼 Cloudaware Framework → 💼 General Access Controls			26		no data