General

This alarm is triggered when the account intended for emergencies is used.

Rationale

The emergency account has the highest privileges but no two-factor authentication. This is intentional, to provide a way to access the environment when the second factor method fails on a large scale. However, if there is no reason, the account should not be used. This makes any unplanned use of the account suspicious: the password may have fallen into the wrong hands.

Follow-up

Perform these steps to adequately follow up on this detection:

1. Check with colleagues who have access to the login credentials of the emergency account if it was planned.
   
   
2. If not: consider the emergency account as compromised:
   1. Reset the password of the emergency account
   2. Revoke all logged-in sessions of the emergency account
   3. Consider conducting an Attic Tier2 investigation to learn more about the attack (who, what, when, where, why, how?). This is strongly advised since the executing user is a different person than the owner of the mailbox.
      
      
3. If yes: close the Attic incident as resolved

More Information

1. https://learn.microsoft.com/nl-nl/entra/identity/role-based-access-control/security-emergency-access#monitor-sign-in-and-audit-logs