PA-03: Configure Emergency Access Accounts

PA-03 is a security control that emergency access accounts prevent permanent lockout if mfa systems fail, conditional access is misconfigured, or a federation service goes down. microsoft recommends 2 accounts with fido2 keys stored securely offline. It requires that at least 2 break-glass accounts exist and accounts are excluded from all conditional access policies, accounts are enabled and accessible.

Emergency access accounts prevent permanent lockout if MFA systems fail, Conditional Access is misconfigured, or a federation service goes down. Microsoft recommends 2 accounts with FIDO2 keys stored securely offline.

TrueConfig provides one-click remediation for PA-03. Creates cloud-only break-glass accounts with Global Admin role, excluded from CA policies

This control can be implemented with any Microsoft 365 subscription, including free Azure AD.

PA-03 is included in the TrueConfig Recommended Secure baseline (Level 1). This is the foundation level suitable for most organizations.

PA-03 is rated critical because failure to implement this control significantly increases the risk of security incidents. Emergency access accounts prevent permanent lockout if MFA systems fail, Conditional Access is misconfigured, or a federation service goes down. Microsoft recommends 2 accounts with FIDO2 keys stored securely offline.