SC-300 Certification Practice Question #222

Question

You have a Microsoft 365 tenant.
The Azure Active Directory (Azure AD) tenant syncs to an on-premises Active Directory domain.
You plan to create an emergency-access administrative account named Emergency1. Emergency1 will be assigned the Global administrator role in Azure AD.
Emergency1 will be used in the event of Azure AD functionality failures and on-premises infrastructure failures.
You need to reduce the likelihood that Emergency1 will be prevented from signing in during an emergency.
What should you do?

Accepted Answer

The question asks how to *reduce the likelihood the break-glass account is prevented from signing in*. Microsoft's emergency-access guidance is explicit that break-glass accounts should be *excluded* from Conditional Access and MFA so a misconfiguration can never lock them out, while their sign-in and audit activity should be *monitored with alerts*. Options B (PIM activation requirement), C (location-restricted CA policy), and D (MFA CA policy) each introduce a new dependency that could itself block sign-in during an outage — the opposite of the goal. That leaves A: monitoring/alerting is the only control that protects the account without adding a sign-in barrier. The community broadly agrees A is the answer "by elimination" (the heavily voted comments concede the phrasing is awkward, which is why confidence is 88 rather than higher).

More SC-300 practice questions