Microsoft Entra emergency access accounts: create, protect and monitor break-glass access

A break-glass account exists for failure of normal controls

A Microsoft Entra emergency access account is not a spare administrator for daily work. It exists for rare cases where normal accounts are blocked: a Conditional Access mistake, identity-provider outage, loss of MFA factors, PIM problem or unavailable admin workstations.

Microsoft recommends at least two cloud-only emergency accounts with a permanent active Global Administrator assignment. Redundancy covers a lost credential, configuration error or physical loss of one location.

• Microsoft — Manage emergency access accounts ↗
• Related guide — Microsoft 365 token theft →

Recommended architecture

Accounts should not be tied to a person, personal phone, mailbox or automation. Use names the team can recognize but that are not publicly obvious, and record Object IDs for alerting.

Create accounts without hybrid dependencies

Create identities directly in Entra using the onmicrosoft.com domain. Do not synchronize them from Active Directory or federate them: a local outage or synchronization rule must not prevent emergency access.

Assign Global Administrator permanently and actively. Avoid unnecessary licences and applications. Restrict usage through the operating procedure, then monitor all activity instead of adding technical dependencies that may block sign-in.

Connect-MgGraph -Scopes 'User.Read.All','RoleManagement.Read.Directory'
$accounts = @('ea-admin-01@contoso.onmicrosoft.com',
              'ea-admin-02@contoso.onmicrosoft.com')
foreach ($upn in $accounts) {
  Get-MgUser -UserId $upn -Property Id,DisplayName,UserPrincipalName,
    AccountEnabled,CreatedDateTime |
    Select-Object Id,DisplayName,UserPrincipalName,AccountEnabled,CreatedDateTime
}

• Microsoft — Entra role best practices ↗

Choose independent phishing-resistant authentication

A FIDO2 security-key passkey is the simplest choice for many organizations. Use two separate keys per account where the process permits and label them without exposing the account. Certificate-based authentication fits when the PKI will remain available in the failure scenario.

Do not use the same factor as regular administrators. An emergency account dependent on the same phone, Authenticator app or federated provider does not cover the outage. Credentials must not expire or be automatically removed for inactivity.

• Related guide — Deploy passkeys with Entra ID →

Exclude precisely from Conditional Access

Create a dedicated static group such as EmergencyAccess and exclude it from every Conditional Access policy that can block or restrict sign-in. This includes MFA, compliant device, location, authentication strength, risk and terms-of-use requirements. Report-only policies do not block and need no exclusion.

An exclusion is not a security exemption. Protection comes from phishing-resistant authentication, physical custody, monitoring and exceptional use. Every new policy review should include the emergency group.

• Use a dedicated static group.
• Exclude it from all existing blocking policies.
• Add the exclusion before enabling a new policy.
• Check with What If and a controlled real sign-in.
• Alert on group membership changes.

Alert on every sign-in and modification

A successful sign-in, failed attempt, authentication-method change or role change should alert. Send Entra logs to Log Analytics or Microsoft Sentinel and key detections on Object IDs rather than display names.

Alert delivery must not depend on the emergency account. Notify multiple administrators and the incident channel, retaining IP, country, device, application, Conditional Access result and correlation context.

let EmergencyAccounts = dynamic([
  "00000000-0000-0000-0000-000000000001",
  "00000000-0000-0000-0000-000000000002"
]);
SigninLogs
| where UserId in (EmergencyAccounts)
| project TimeGenerated, UserPrincipalName, ResultType, ResultDescription,
          IPAddress, Location, AppDisplayName, ConditionalAccessStatus, CorrelationId
| order by TimeGenerated desc

let EmergencyUPNs = dynamic([
  "ea-admin-01@contoso.onmicrosoft.com",
  "ea-admin-02@contoso.onmicrosoft.com"
]);
AuditLogs
| where tostring(TargetResources) has_any (EmergencyUPNs)
| project TimeGenerated, OperationName, Result, InitiatedBy, TargetResources, CorrelationId
| order by TimeGenerated desc

• Microsoft — SigninLogs schema ↗

Keep credentials under operational control

Store keys and the procedure in separate secure, fire-resistant safes accessible to authorized people. Dual control reduces covert use but must remain practical during a real outage. Document who authorizes opening, who witnesses the action and how work is recorded.

Do not keep the only PIN, password or procedure inside Microsoft 365. Maintain an offline copy with Microsoft support contacts, tenant identifiers and steps for signing in from the secure workstation.

Test every 90 days

Microsoft recommends validating accounts at least every 90 days. Test more than the credential: retrieve the key, sign in from the intended workstation, open the admin center, confirm the role and verify alert delivery.

Run the drill as a planned change. Do not use the account for unrelated work. Review logs, return keys, close sessions and record results afterward.

Incident-use procedure

• Declare the incident and obtain required authorization.
• Retrieve a key under shared control.
• Use the designated secure administrative workstation.
• Open one session and confirm that normal admin access is affected.
• Perform only the actions needed to restore administration.
• Record changes, times and people involved.
• Close sessions, secure the key and conduct a post-incident review.
• Rotate or replace the method if custody may have been exposed.

Common mistakes

Two well-designed accounts are inexpensive, but they must be treated as a continuity control. Quality is measured by working during an outage while making every use immediately visible.

• Service — Microsoft 365 security assessment →
• Related guide — Secure Microsoft 365 administrators →