Exclude at least one emergency/break glass account or group

[iahmed18]

Hi,

In the Maester test report, one of the tests failed with the following reason:
"All Conditional Access policies are configured to exclude at least one emergency/break glass account or group."

However, upon investigation, we found that the account mentioned in the Maester test report does not exist in Entra ID. We are unsure on what basis Maester detected this Break Glass account. If it had detected the original Break Glass account, it should be present, but it is not found.

Could you please assist in understanding how Maester identifies Break Glass accounts in this case? Any guidance or clarification would be highly appreciated.

Looking forward to your support.

[ChristopheLux]

Hello @iahmed18
the PowerShell for the test is here https://github.com/maester365/maester/blob/3b82268b621fe9c2468bbef560433be2b3d6eb0c/powershell/public/Test-MtCaEmergencyAccessExists.ps1

KR

[iahmed18]

Hi Chris,

The issue is not with running test, issue is that output is not as expected. In test result showing there is one "Break Glass account" but in Entra this account is not exist.

[ChristopheLux]

Yes I understood your point but the best way to see hot it works it is to look at the code...that was my point