Alert on every use of emergency access accounts

Description

Every sign-in attempt (successful or failed) and every audit event performed by an emergency access (break-glass) account raises an alert within minutes to the security team and to several administrators, by email and by a second channel (SMS, phone call, incident tool). The rule is based on the object IDs of the accounts, not on their names, and is tested at least twice a year during the emergency access drill.

Rationale

Emergency access accounts are excluded from most Conditional Access policies and have permanent Global Administrator rights (CB-M365-ADMIN-002). Their use should be rare and planned; any unexpected use is either an emergency the team must know about, or a compromise. Immediate alerting is the compensating control for their exclusions.

Impact

Requires Microsoft Entra sign-in logs in a Log Analytics workspace, Microsoft Sentinel or another SIEM (CB-M365-AUDIT-002), or Defender XDR custom detections. Planned drills trigger the alert: announce them to the SOC.

Audit

1. Get the object IDs of the emergency access accounts from the administrators (Entra ID > Users > the account > Object ID).
2. In the Azure portal (https://portal.azure.com) as at least a Monitoring Reader, browse to Monitor > Alerts > Alert rules (or in Microsoft Sentinel, Analytics; or in the Microsoft Defender portal, Hunting > Custom detection rules) and find a rule that queries SigninLogs (and AADNonInteractiveUserSignInLogs, AuditLogs) for these object IDs, runs at least every 5 to 15 minutes, and triggers on one result.
3. Open the action group and check that it notifies the security team and several administrators through at least two channels.
4. Ask for the record of the last drill showing that the alert fired.
5. Fail if no rule exists, if it misses an account or uses only the display name, if it runs less often than every 15 minutes, or if it has never been tested.

Remediation

1. Send Microsoft Entra sign-in and audit logs to a Log Analytics workspace or SIEM (CB-M365-AUDIT-002).
2. In the Azure portal as at least a Monitoring Contributor, browse to Monitor > Alerts > Create > Alert rule, select the Log Analytics workspace, and use a custom log search such as: SigninLogs | where UserId in ("<objectId1>", "<objectId2>") (repeat for AADNonInteractiveUserSignInLogs and AuditLogs on InitiatedBy.user.id).
3. Set Threshold value to 0 with operator Greater than, and frequency to 5 minutes.
4. Attach an action group that emails the security team and administrators and sends an SMS or creates an incident.
5. Test the rule by signing in with each account during a planned drill.

Rollback

Disable the alert rule (not recommended).

References

• Manage emergency access admin accounts Microsoft, vendor-doc, accessed 2026-10-24
• ASD Blueprint for Secure Cloud Australian Signals Directorate, guide, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-M365-AUDIT-002 Forward Microsoft 365 security logs to the SIEM or SOC
• related CB-M365-ADMIN-002 Keep two protected emergency access accounts

People and lifecycle