A compost-authority tabletop showed both Global Administrators would be locked out if the sole MFA method vendor failed. What should the security engineer configure for Azure-management MFA enforcement?
Select an answer to reveal the explanation.
Short Explanation
Keep two sealed emergency keys—cloud-only break-glass accounts—outside the Azure-management MFA policy so you are not locked out of the building when the MFA vendor goes dark. Do not simply turn MFA off for every admin.
Full Explanation
Emergency access (break-glass) accounts should be cloud-only, highly protected, and excluded from Conditional Access policies that could lock out all administrators when MFA providers fail. After the compost-authority tabletop showed both Global Administrators would be locked out if the sole MFA vendor failed, the security engineer should exclude two cloud-only emergency access accounts from the Azure-management MFA Conditional Access policy so Azure management can still be recovered.
Disabling MFA for all Global Administrators fails security and expands permanent risk far beyond an emergency path. Storing Global Administrator passwords in a shared spreadsheet excluded from Conditional Access fails operational security and auditability. Converting both Global Administrators to eligible PIM only and removing all break-glass identities fails the tabletop lesson: without emergency accounts, approval or MFA outages can still strand the tenant.
Exam caveat: use at least two break-glass accounts, monitor their sign-ins, and keep them out of day-to-day use. Operational check: document the two cloud-only emergency accounts, exclude them from the Azure-management MFA policy, test that normal admins still get MFA, and verify emergency accounts can authenticate per the documented break-glass procedure during a controlled drill.