Emergency Access account monitoring

[RobertEllis]

Various best practice recommendations seem to suggest that Emergency Access accounts should be configured to guard against becoming locked out of your own tenancy (e.g. as in the case of a botched Conditional Access policy)

Moreover, best practice recommendations seem to suggest that these accounts (and perhaps all "high privilege" accounts) should be Monitored with Alerts set up to report on Sign In activities.

I have recently been spending some time setting up Alerts in Azure Monitor for this purpose, and the most granular interval available for an alert to be fired is at roughly 5 minute intervals, as I understand it and from what I can see.

Given that it may take at least 5 minutes for an alert to be raised following a Sign in, then if we presume this to be an unauthorised sign in, this scenario would seem to leave more than adequate time for the bad actor to simply navigate to the Alert configuration and suppress it.  At that point, he has the keys to kingdom and nobody has been alerted.

Questions

1. To what extent does the above observations undermine the apparent purpose of configuring the Alerts? If we know that they can easily be suppressed, what's the point?

2. Following on from the above - is there any way to configure the Azure Portal so that a Global Admin account cannot configure Monitor / Alerts?

3. Are Alerts actually the best available signal of unauthorised access activities, given the relatively slow response time, 5 mins+ ?

I think the answers to these questions may be of enough significance for us to begin considering using an "independent" MFA solution for the emergency access accounts. I'd be interest to know what other people are thinking and doing on this.

thanks

[#2]

Hi
Global admin can manage all aspects of Azure AD and Microsoft services that use Azure AD identities. But there is no way for the global admin to modify anything in the Azure Subscription unless he have RBAC roles ( Contributor or Owner or any other role assignment that can allow to manage alerts .
The Frequency of the evaluation cannot be under 5 minutes
You will probably need to stream it to an ITSM or a supported SIEM tool
https://docs.microsoft.com/EN-US/azure/active-directory/reports-monitoring/tutorial-azure-monitor-st...

In my Opinion if you generate a random 32 characters Password with characters or whatever that can make it robust 5 min is not enough to crack it then use it and make damage .
By the way if you want to avoid people having permanent high privileges and be able to review and revoke access you can consider PIM .
https://docs.microsoft.com/EN-US/azure/active-directory/privileged-identity-management/pim-configure

[#3]

Thanks for responding. I am not sure this answers the question, though.
If a GA can manage all aspects of AD, then he can turn off the Alerts. If he can turn off the Alerts, then he has the keys to the kingdom and nobody knows...

[#4]

No subscription access need to be configured before . And there is a good news for you maybe now you can pass from 5 to 1 min for the frequency . (Its in preview ). https://azure.microsoft.com/en-us/updates/public-preview-stateful-and-1minute-frequency-log-alerts-i...

[#5]

I think what you are saying is that the Emergency account can be denied access to the Subscription but I can only reiterate, this doesn't solve the problem.
The Alerts are defined in AAD. The emergency account has to be a GA. If the Emergency account is denied access to the Subscription, you wouldn't be able to use it in an emergency......