Concept

With the introduction of Just In Time and Privileged Identity Management accounts, using a Global Administrator account to manage Azure/Entra is no longer recommended.

As per Microsoft's KB, it is advised to secure a Global Administrator account (or multiple) for Emergency Access use only.

To facilitate this, CyberQP is providing this KB Article to outline a method to ensure that the Emergency Access Account password remains unchanged by Quickpass.

Prerequisites

• Azure/Entra Tenant for Customer
• Quickpass Subscription
• Quickpass Customer linked to Azure/Entra Tenant (https://support.getquickpass.com/hc/en-us/articles/360039678373-How-to-Connect-an-Azure-AD-Office-365-tenant-to-a-Quickpass-Customer)
• Microsoft Entra ID P1 license for each administrative unit administrator who is assigned directory roles over the scope of the administrative unit:
  https://learn.microsoft.com/en-us/azure/active-directory/roles/administrative-units#license-requirements
• Current Account able to set up Administrative Units in Azure/Entra
• Created Account(s) to use as Emergency Access Accounts
  https://learn.microsoft.com/en-us/azure/active-directory/roles/security-emergency-access#create-emergency-access-accounts 
  • Ensure that the accounts used for this purpose have ALL access to Azure/Entra required for full access (including subscription, Roles, etc.)

Implementation

Log into the Management Portal

Azure Portal	Entra Admin Center
Click Microsoft Entra ID	Expand the Identity -> Roles and Admins Section
Select Administrative Units	Select Admin Units
Click Add
Enter a Name and Description that is Appropriate
Ensure that the "Restricted management administrative unit" Toggle is set to YES
On the Assign Roles screen you can leave the Defaults
Once you have confirmed everything is correct click Create

Denying access to the Emergency Access Accounts

With this configuration you are explicitly DENYING Quickpass from accessing the Emergency Access Accounts.  Quickpass will NOT be able to rotate the passwords for these accounts, keeping with Microsoft's direction.

1. Click on the newly created Administrative Unit
2. Click Add Member at the top of the screen
3. Search for any account(s) you wish to exclude from rotation by Quickpass.
4. Put the check mark in the Box to add the account and then repeat until all accounts have been added.
   
5. Once all accounts you want to exclude have been added, click Select
   1. The account(s) in the list will no longer be able to be managed by the Quickpass Enterprise App
   2. All accounts NOT in the list will still be able to be accessed by the Quickpass Enterprise App.

NOTE: Because the account(s) attributes that you have added to this Administrative Unit can still be READ by the Quickpass Enterprise app, they will still get imported if you have Automatic Import configured by Azure/Entra Role. We recommend turning OFF the Automatic rotation toggle for these accounts to avoid errors on each rotation cycle.

If someone were to attempt to change the password or rotate that account's password using Quickpass, the following error will be displayed.