MT.1191: Break-glass accounts should be excluded from the Compliant Network Conditional Access policy.
| ID | MT.1191 |
| Severity | Medium |
| Suite | Mito |
| Product | Entra ID |
| Feature | Global Secure Access |
| Security area | Privileged access |
| Resource type | ConditionalAccessPolicy |
| User impact of fixing | Low |
| Effort to fix | Low |
| Reads from | Microsoft Graph |
| Licence needed | AAD_PREMIUM |
| Lifecycle | Preview |
What this checks and how to fix it
Section titled “What this checks and how to fix it”A Conditional Access policy that enforces the Global Secure Access Compliant Network control blocks access when the session is not on a compliant network. If such a policy does not exclude the emergency access (break-glass) accounts, it can lock out the very accounts needed to recover the tenant during an outage or misconfiguration.
Every Compliant Network enforcement policy must therefore exclude all break-glass accounts - either directly, or via a group they belong to (nested group membership is honored, as Conditional Access evaluates it). Emergency access accounts are read from the EmergencyAccessAccounts setting in the Mito assessment configuration.
Remediation action
Section titled “Remediation action”- Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
- Browse to Entra ID > Conditional Access > Policies and open each flagged policy.
- Under Assignments > Users > Exclude, add the emergency access accounts or the break-glass group.
Related links
Section titled “Related links”- Manage emergency access accounts in Microsoft Entra ID
- Enable compliant network check with Conditional Access
Mito check. Author: crmhh. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.