What is a break-glass account?

A break-glass account is a spare admin account with top-level rights, kept for the moment your normal admin accounts stop working.

What is an emergency access account?

Microsoft Entra ID’s documentation calls it an emergency access account, meant for “break glass” scenarios. The account holds the Global Administrator role, which Microsoft describes as highly privileged. Microsoft says to use it only when normal admin accounts can’t be used, and only when it’s absolutely necessary.

What is a break-glass account for?

It exists so that you never reach a point where nobody can sign in as an admin. Microsoft lists the situations it covers:

• Your identity provider is down. If people sign in to Microsoft through a separate identity provider and it goes offline, they may not be able to sign in.
• Admins can’t complete multi-factor authentication (the second check after the password). For example, a cell network outage stops calls and texts from reaching their phones.
• The last person with Global Administrator access leaves. Entra ID won’t let that account be deleted, but your on-premises directory (such as Active Directory) can still delete or disable it.
• A natural disaster takes out phones or networks.
• Every Global Administrator and Privileged Role Administrator assignment needs approval to turn on, and no approver is left to give it.

For these cases Microsoft recommends two or more emergency access accounts. They should be cloud-only accounts that aren’t linked to another identity provider or synced from an on-premises directory.

What does “not used day to day” mean in practice?

Microsoft’s guidance sets out rules that keep the account apart from daily work. Don’t tie it to any one person. Store its sign-in details somewhere secure that several members of the admin team know about. Don’t connect it to employees’ own devices, such as phones. If you prefer, you can create a separate emergency account for each admin instead, which makes it easier to tell who used one.

The sign-in method should differ from what your normal admins use. If they use the Microsoft Authenticator app, Microsoft’s example is a FIDO2 security key (a small hardware key) for the emergency accounts. Microsoft recommends a passkey (FIDO2) or certificate-based sign-in. Both count as multi-factor authentication, which Microsoft requires. Keep the keys in fireproof safes in separate, secure places.

Last, keep the accounts outside any Conditional Access policy that would block or limit their sign-in. Conditional Access is Entra ID’s way to allow or block sign-in based on conditions such as device or location. A policy like that could lock the account out in the very emergency it exists for.

What happens after someone uses it?

Every sign-in should trigger an alert to the other admins, and the sign-in and audit logs should be kept. Microsoft then asks for a review of each use. The review decides which of three things the use was: a planned drill, a real emergency in which no admin could use a normal account, or misuse. After that, check the logs for what the person did, and confirm that those actions stayed within the account’s authorized use.

What do you check on a schedule?

An account nobody touches can fail when you finally need it. Microsoft asks you to run drills at least every 90 days. Run them as well after IT staff changes, such as someone leaving or changing jobs, and when your Microsoft Entra subscriptions change. Each drill confirms that the accounts can sign in and do admin work. It also updates the list of people allowed to use them and keeps the written procedure current. Reset safe combinations on a schedule, and whenever someone who knew them leaves. For admin accounts in general, see Managing privileged accounts.