According to Microsoft’s official SC-300 Identity and Access Administrator study guide and Microsoft Learn module: Manage emergency access accounts in Azure AD , an emergency access (break-glass) account must always be configured to maintain administrative control during service outages or authentication failures. The study material explicitly emphasizes that these accounts must not rely on on-premises infrastructure or Conditional Access policies that could block sign-ins in an emergency. The recommended configuration is to exclude the emergency account from Conditional Access rules, enable cloud-only authentication, and require strong authentication (MFA) to prevent compromise.

The exam guide states:

“Emergency access accounts should be cloud-only, assigned the Global Administrator role, and configured with multi-factor authentication that does not depend on the organization’s normal identity provider or on-premises systems.”

Options like restricting sign-in to corporate networks (Option C) or requiring Privileged Identity Management activation (Option B) could lock out access if the Azure AD or network is unavailable. Azure Monitor alerts (Option A) help with monitoring but do not prevent sign-in issues. Therefore, the correct answer per Microsoft’s best practice is to enforce MFA for the account to ensure security without relying on on-premises dependencies.