🚦🔴👨💼CA - Block External login for BTG
The emergency account that can do anything, allowed to do it from exactly one room and nowhere else on Earth.
What this policy is about 🔓
Break-the-Glass accounts are the tenant's spare keys: excluded from your MFA and device policies on purpose, so that when a Conditional Access change locks everyone else out at 3am, someone can still get in and fix it. That exemption is also their weakness. A BTG credential that leaks is a Global Admin with no second factor to stop it. This policy fences that risk in geographically: the Break the Glass group is blocked from every location except the Panic Room named location. Everywhere else, the answer is no.
It is Mjolnir logic. The account can do anything, but only for whoever is standing in exactly the right spot; lift it anywhere else and nothing happens.
Almost every other policy excludes the BTG group so the emergency door never locks. This one is the mirror image: it includes the BTG group and blocks it, then carves out the Panic Room as the single allowed location. One policy replaces an exclusion you would otherwise have to babysit in every future rule.
Why this matters 🕵️
The whole point of a break-glass account is that it sidesteps the controls protecting everyone else, which means the usual safety nets, MFA, compliant device, sign-in frequency, do not catch a compromise of it. If the credential is phished, sold, or fished out of the wrong password vault, an attacker holds an unrestricted admin login with nothing standing in the way. That is the one account you cannot afford to leave open to the internet.
Pinning it to a location turns a stolen credential into a paperweight. The attacker has the username and password and still cannot sign in, because they are not originating from the trusted address the Panic Room defines. It also keeps every other policy clean: instead of remembering to exclude BTG in each new rule you write, you contain the account here, once, and let the rest of the baseline treat it like any other locked-down identity.
🛠️ Configuration
Where: Entra admin center → Protection → Conditional Access → Policies.
| Setting | Value |
|---|---|
| Users, include | 🛡️🧑💼⛓️🔓🚦Group - Break the Glass solution |
| Users, exclude | None |
| Conditions, locations | Include All, exclude 📍🟢NLOC - Panic Room |
| Target resources | All cloud apps |
| Grant | Block access |
| Session | None |
The mechanism is the location condition, not a grant. The policy fires on all locations, the Panic Room is excluded from that set, so a sign-in from inside the Panic Room simply falls outside the policy and passes, while everything else lands on Block access. Get the Panic Room named location right and the whole thing hinges on it.
Roll it out in Report-only first and confirm two things in the sign-in logs: a legitimate test from the Panic Room is not matched, and a sign-in from anywhere else is. Only then flip it On, or you risk fencing your emergency account out of its own escape hatch.
Caveats ⚠️
The Panic Room is now a single point of failure. This policy is only as trustworthy as the named location behind it. If that IP is a home broadband line that renumbers, or a VPN egress you decommission, the block quietly turns into a lockout. Treat the Panic Room address as protected infrastructure and validate it on a schedule.
Test the glass before you need to break it. A break-glass account you have never signed into is a theory, not a control. Do a periodic, logged sign-in from the Panic Room to prove the account still works and the location still resolves, then log and alert on every use, successful or failed.
Location is not a factor, it is a filter. IP-based trust helps an attacker who is not on your network; it does nothing about one who is, or who proxies through it. This policy narrows where the credential works, so keep the credential itself in a separate, audited vault, not the daily-driver password manager.
License and reversibility. Conditional Access is Entra ID P1, included in Business Premium. Clean-revert: set it to Off and the BTG account can sign in from anywhere again, which is exactly why a disabled break-glass containment policy belongs in drift detection, it is your most powerful account going back off its leash unnoticed.
🔗 Related
- 🛡️🧑💼⛓️🔓🚦Group - Break the Glass solution: the emergency accounts this policy fences in.
- 📍🟢NLOC - Panic Room: the one location the block deliberately lets through.
- 🚦🟢👨💼CA - MFA for All Users: the everyday-identity floor that the BTG accounts are exempt from, which is precisely why they need this.
A break-glass account is only safe when a leaked copy is useless, and a copy is useless when it can only be lifted from one room. 🔓