Tim
Tim Semperis Senior Solution Architect

Back Into My Tenant

Back Into My Tenant

Back Into My Tenant

This post is also available in German.

In my job at Semperis, I deal more and more with disaster recovery for Entra ID (formerly Azure AD). One question comes up again and again: how do you get back into your own tenant once an attacker has taken control of it? In this post I want to share a few approaches and thoughts on that.

Shared Responsibility Model

Microsoft runs Entra ID and makes sure the infrastructure is secure and available. Managing and protecting your own tenant, however, is your job as the customer. That means you need the right security controls in place: solid identity and access management, regular reviews of your security policies and an emergency plan.

To name them:

  • Strong authentication like multifactor authentication (MFA) and Conditional Access.
  • A robust Conditional Access concept, so privileged accounts only get access when several conditions are met.
  • Regular reviews of your security policies, so they keep up with current threats.
  • Emergency plans, so you can react fast when a security incident happens.

Disaster Recovery Strategies

There are several strategies you can implement to make sure you get access back if your Entra ID tenant is attacked or compromised. Some of them:

  • Emergency access accounts: Set up dedicated accounts that are only used in an emergency. They need strong authentication and regular reviews – also known as break glass accounts. This can be a regular user account or an app registration with privileged permissions. I covered both options in BreakGlass Accounts.

  • Lifecycle plans for privileged accounts: Define clear processes for privileged accounts, so they’re reviewed and updated regularly. Privileged Identity Management (PIM) helps you with that.

    Warning: your break glass account must not be in “eligible” state. This leads to the following problems:

    • If the Global Administrator role requires approval, the emergency account can’t be used, because there’s no approver left.
    • If an attacker removes your P2 licenses, eligible assignments are removed – and your break glass account has no permissions left.

Worst-Case Scenario

Now imagine none of these measures work anymore. The attacker has compromised all of your emergency access accounts and you’ve lost access to your tenant. In that case, you have to rely on Microsoft. Microsoft has a support process for exactly this situation and helps customers get back into their tenant. This process can take time, though, and usually requires you to prove your identity as the customer.

So make sure you have all the required information and evidence ready to make this process as smooth as possible. Ask your Microsoft contact about the exact requirements and how the process works. If they don’t know right away, they may need to clarify it with the Entra ID product team – or open a support ticket with Microsoft and ask how the process works.

Conclusion

Securing and restoring access to an Entra ID tenant is a complex task that needs careful planning. Make sure you have the right security controls and emergency plans in place, so you can react fast when an attack happens. And in the worst case, be ready to engage Microsoft support to get back into your tenant – and know the process before you need it.

References: