maester365
MT.1036 - Includes break glass accounts
I'm not sure if this is expected behaviour, but MT.1036 is failing against the break glass account(s). Can you please confirm whether or not it should be failing? It may be beneficial to directly refer to break glass accounts in the documentation of this test for clarification.
https://maester.dev/docs/tests/MT.1036/
If break glass accounts should be caught by this, shouldn't there be separate test to ensure the right kind of protection is against the break glass accounts? Technically something the opposite of what MT.1005 is doing?
As an update to this, I created a fallback policy for my break glass accounts, to enforce phishing resistant MFA which would hopefully remediate against this, but not MT.1005 fails as my break glass accounts aren't excluded.
