How to Exclude Service Accounts from MFA in Azure Security Defaults
Question details
The user needs to exclude emergency access (break-glass) or service accounts from Multi-Factor Authentication (MFA) while Azure AD Security Defaults are enabled.
- Product
- Azure Active Directory
- Device & OS
- not provided
- Scenario
- Configuring selective MFA policies for specialized administrative or automated service accounts.
- Observed behavior
- Azure AD Security Defaults enforce MFA universally across the tenant and do not provide an option for granular user exclusions.
Ensure you have Global Administrator privileges in your Azure AD tenant and have your emergency access accounts clearly documented before modifying tenant-wide authentication settings.
Transition from Security Defaults to Conditional Access
Since Security Defaults do not support granular exclusions, you must switch to Conditional Access policies to enforce MFA while excluding specific service accounts.
Azure AD Security Defaults provide a one-size-fits-all MFA enforcement to protect organizations at no additional cost. However, to exclude break-glass or service accounts, you must first disable Security Defaults and then recreate the baseline protections using Conditional Access.
Log in to the Azure portal as a Global Administrator. In the left-hand navigation, select 'Azure Active Directory' (or Microsoft Entra ID), then click on 'Properties'.
Click on the 'Manage security defaults' link at the bottom of the Properties page. Toggle 'Enable security defaults' to 'No', select an applicable reason for disabling, and click 'Save'.
Navigate back to the Azure AD menu, go to 'Security', and select 'Conditional Access'. Click on 'New policy' to begin defining your organization's MFA rules.
Under 'Users and groups', choose to include 'All users'. Then, switch to the 'Exclude' tab and select the specific break-glass or service accounts you wish to exempt from MFA.
Under 'Grant', select 'Require multi-factor authentication'. Set the policy to 'On' and save your configuration to apply the targeted MFA requirements.
Configure Per-User MFA (For Non-Premium Tenants)
If your organization does not have the premium licenses required for Conditional Access, you can disable Security Defaults and manage MFA on a per-user basis.
Looking for a Lightweight, Secure Office Suite?
While managing complex Microsoft 365 and Azure AD environments can be challenging and costly, equipping your team with a reliable productivity suite shouldn't be. WPS Office offers a free, highly compatible alternative to Microsoft Office, perfect for organizations seeking efficiency without heavy administrative overhead.
- 1. Download the Installer: Visit the official WPS Office website and download the installation package tailored to your operating system.
- 2. Install WPS Office: Run the downloaded installer and follow the quick setup wizard to install the lightweight suite on your device.
- 3. Open Your Office Files: Launch WPS Office and directly open any existing Microsoft Office documents without worrying about formatting loss.
Frequently Asked Questions
Can I exclude just one service account while keeping Security Defaults enabled?
No. Azure AD Security Defaults applies a baseline of security policies across your entire tenant and inherently does not support granular exclusions. To manage exceptions, you must disable Security Defaults.
What is considered a break-glass account in Azure AD?
A break-glass account (or emergency access account) is a highly privileged, dedicated account used only when normal administrative accounts cannot be accessed. These accounts are often excluded from MFA to guarantee immediate access during critical system failures.
Will disabling Security Defaults leave my Azure tenant vulnerable?
Yes, disabling Security Defaults removes baseline protections. It is crucial to have an alternative security mechanism, such as Conditional Access policies or per-user MFA, fully configured and ready to enable immediately after turning off Security Defaults.
Do I need a special license to use Conditional Access?
Yes, Conditional Access requires at least an Azure AD Premium P1 license. This license is included in subscriptions like Microsoft 365 Business Premium, E3, and E5. Free tier users must use per-user MFA instead.
