Break-glass accounts done right

If a Conditional Access policy locks everyone out, your MFA provider has an outage, or your federation service goes down, you need a way back in. That's what emergency access, or "break-glass", accounts are for.

The setup

• Two accounts, so one can be used while the other is investigated or has its credentials rotated.
• Cloud-only, using the .onmicrosoft.com domain. They mustn't depend on on-premises AD, sync or federation.
• Permanent Global Administrator, not PIM eligible. PIM is one more thing that could fail during an emergency.
• Not tied to a person. No mailbox you rely on, no personal phone number.

Authentication

Microsoft now enforces MFA for sign-ins to Azure and the admin portals, and that includes emergency accounts. The best option is phishing-resistant: FIDO2 security keys, registered to each account and stored securely in separate physical locations. Keep a backup key for each.

Conditional Access

Exclude at least one break-glass account from every Conditional Access policy, so a broken policy can't lock it out. The easiest way is a dedicated exclusion group used consistently across policies. Review the group's membership regularly, because it's a high-value target.

Monitoring

These accounts should almost never sign in, so any sign-in is worth an alert. With sign-in logs in Log Analytics:

SigninLogs
| where UserPrincipalName in~ ("bg-admin1@contoso.onmicrosoft.com", "bg-admin2@contoso.onmicrosoft.com")
| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, ResultType

Turn that into an alert rule that notifies the security team immediately.

Test it

Every few months, sign in with each account, confirm the key works and the alert fires, and record the test. An emergency account nobody has tested isn't an emergency account.

Writing the procedure

An emergency is the worst time to work out the steps. Write a one-page procedure and store it where it can be found when Entra is unavailable, such as a sealed envelope or a password manager outside your tenant. Include:

• Who is allowed to use the accounts and who must approve it.
• Where the keys are kept and who holds access to each location.
• What to do first once signed in, for example disabling the broken Conditional Access policy.
• Who to tell afterwards, and how to reset and re-secure the account.