Forum Discussion

Chuck99's avatar
Chuck99
Brass Contributor
Jul 09, 2020

Protecting Breakglass account with 3rd party MFA?

Hi,

 

As recommended by Microsoft, we have configured our tenant to enforce a Conditional Access policy for all our Global admin accounts BUT for an account that we will use only in case of a situation where other global admin accounts would not be able to sign-in. As recommended, this "breakglass" account is a cloud account, its UPN is using the onmicrosoft.com domain and it is excluded from all Conditional access policies, especially the one that enforces MFA for global admins.

 

I'm trying to find some ways to protect this brreakglass account and for now, all I've done is configuring Azure AD logs export to Azure Log Analytics and use Log Analytics to query the Azure AD sign-in logs every 5 minutes to see if the breakglass account signed-in. If this happens, an alert is send by email and SMS to the IT admins so that they can react quickly if the account has been compromised. Of course, We've configured a complex password as well that is known by almost no one.

 

What I would like to do now is to configure another MFA solution for this account. By that I mean that evert standard user would use the Azure MFA based on the Conditional Access but I would integrate as well a 3rd party MFA solution to be used specifically by the breakglass account. I don't know if this is possible. If not, what else should I do to better secure this sensitive account?

 

Any idea is welcomed!

 

Thanks 

Access Management
Azure Active Directory (AAD)
Identity Management
  • PeterRising's avatar
    PeterRising
    MVP
    Jul 10, 2020

    Chuck99 

     

    Protecting the break glass account with additional authentication security is something that causes great debate among my fellow consultants.  One possible solution could be to use an OAuth token such as a Yubikey device.  You could have a couple of break glass accounts, and get a couple of these tokens, give them to different people and get them to lock them away in a fire proof safe if they have access to one.

     

    It is slightly annoying that Microsoft do suggest that you protect your break glass accounts with an alternative authentication, but do not provide best practice recommendations on how to do this.

Share

Resources