MT.1034: Emergency access users should not be blocked.

ID	MT.1034
Severity	High
Suite	Mito
Product	Entra ID
Feature	Conditional Access
Security area	Privileged access
Resource type	User
User impact of fixing	Low
Effort to fix	Low
Reads from	Microsoft Graph
Licence needed	AAD_PREMIUM

What this checks and how to fix it

Emergency access (break-glass) accounts must stay usable when everything else fails, so Conditional Access policies should not block them.

Mito finds up to five emergency access accounts (the users or group most often excluded from Conditional Access policies) and evaluates a sign-in for each with the Conditional Access What If API. One result is created per account (MT.1034.<n>). The check fails when any policy applies to the account.

Learn more:

• Manage emergency access accounts in Microsoft Entra ID
• Conditional Access What If tool

Remediation action

Exclude your emergency access accounts from the Conditional Access policies that apply to them.

---

Mito check. Author: merill; contributors: f-bader, milanschwartz, jasperbaes. Open-source licences.