setup example

microsoft 365: two emergency access accounts

Emergency, or break-glass, accounts keep you from locking yourself out of your own tenant. Microsoft's guidance in nine steps, with the alert and the 90-day drill that make them trustworthy.

Microsoft 365 and Microsoft Entra IDlast checked 2 November 2026

what it is and when it fits

An emergency access account, also called a break-glass account, is for the day when normal administrators cannot sign in. Microsoft says to use these accounts only in emergencies and to restrict their use to the times when it is absolutely necessary.

Microsoft gives situations where an organization might need one: federation is down because the identity provider is unavailable, administrators registered a second factor on devices that are all out of reach, the person with the latest Global Administrator access leaves, a disaster takes out mobile and other networks, or every privileged role assignment is eligible and nobody can approve an activation.

The accounts should exist before the first policy that could lock you out. That is why the other platform pages ask you to come here first.

fits: Any company with an Entra tenant, and above all one that is about to turn on a second factor or Conditional Access.

before you start

licence: Microsoft's article states no licence requirement for these steps. Privileged Identity Management and the Azure Monitor alert might need licences or cost money, so check Microsoft's licensing pages before you rely on them.
roles: At least User Administrator in the Entra admin center to find the accounts, and at least Monitoring Contributor in the Azure portal to create the alert.
federation: If you federate with an on-premises identity provider, keep emergency access for on-premises systems and for cloud services separate, with no dependency of one on the other.

the steps, in this order

an emergency account you can trust

1createtwo or more cloud-only accounts with Global Administrator
2protecta passkey or certificate that differs from your normal administrators
3excludefrom Conditional Access that blocks or restricts sign-in
4watchan alert on every sign-in
5provea drill at least every 90 days

after any real use, a post-mortem

basis Microsoft Learn, emergency access accounts. The order is practice.

create two or more cloud-only accountsUse the .onmicrosoft.com domain. The accounts must not be federated or synchronized from an on-premises environment. Assign them the Global Administrator role.Entra admin center > Entra ID > Users
choose a passwordless method that differs from your normal administratorsMicrosoft recommends a passkey (FIDO2) and accepts certificate-based authentication if you already run a public key infrastructure. If your administrators use the Authenticator app, use a security key here, so one failure cannot take out both.
register the credentialsEnable passkeys (FIDO2) for the organization, then register one for each emergency account.
do not tie the accounts to a person or a phoneKeep the credentials where several members of the administration team can reach them, and do not connect the accounts to employee-supplied devices. Microsoft also describes one emergency account per administrator as an alternative, which adds accountability.
exclude them from Conditional Access that blocks or restricts sign-inCreate a dedicated security group, for example EmergencyAccess, and exclude it from those policies. Report-only policies do not block anyone and need no exclusion.
make the role assignment permanentIn Privileged Identity Management, make the Global Administrator assignment active permanent for these accounts. The credential and the device must not expire or fall under automated cleanup for lack of use.
store the credentialsKeep them in secure, fireproof safes in separate, secure locations, known only to the people authorized to use them. Sign in from a designated secure workstation, such as a Privileged Access Workstation.
alert on every sign-inSend the Entra sign-in logs to Azure Monitor. Create an alert rule on a custom log search over SigninLogs with the two Object IDs, a static threshold of greater than 0, severity 0 Critical and an action group that emails or texts the administrators. Copy each account's Object ID from its user page first.Azure portal > Monitor > Alerts > Create > Alert rule
```
SigninLogs
| where UserId == "<object id of the first account>" or UserId == "<object id of the second account>"
| project TimeGenerated, UserPrincipalName, UserId, IPAddress, ResultType, ResultDescription
```
run the drill at least every 90 daysAlso run it after a change in IT staff and when the Entra subscriptions change. Check that each account signs in and can do an administrative task, review the list of people authorized to use them, confirm the break-glass process is documented and current, and tell the monitoring staff that a check is planned. Change the combinations on the safes after someone with access leaves.

basis Microsoft Learn, emergency access accounts, read on 2 November 2026. Microsoft notes that organizations in regulated industries might need to show that use of these accounts is governed. The order of the steps is practice.

how to tell it worked

Sign in to each emergency account from the secure workstation and open an administrative page.
Confirm that the alert fired for that sign-in and that the people on the action group received it.
Check that nothing is registered to one person's device or personal details, such as multifactor authentication or self-service password reset.

what goes wrong

an account that Conditional Access locks out

If an emergency account falls under a policy that requires multifactor authentication, a compliant device or another control, it might be unusable in the exact situation it exists for. Test it every quarter against your current policies.

credentials that belong to one person's phone

Microsoft's examples include a mobile network outage and a lost device. An account that depends on one phone fails the same way as the accounts it was meant to back up.

the last Global Administrator leaves

Entra prevents the last Global Administrator account from being deleted, but it does not prevent the account from being deleted or disabled on-premises. Either could leave the organization unable to recover it.

every admin role is eligible and nobody can approve

If all Global Administrator and Privileged Role Administrator assignments are eligible, activation needs approval and no approvers are selected, tenant administration can be locked. Active administrators are the default approvers, and with none active nobody can approve.

an account nobody tests

A credential that expires or is cleaned up for lack of use fails when it is needed. The 90-day drill is how you find out first.

the evidence it leaves

show	owner	refresh
list of the emergency accounts, the people authorized to use them and the date of the last review	head of IT	every 90 days
record of each drill: date, who signed in and what they did	head of IT	every 90 days
the alert rule configuration and the log of a test alert	head of IT	yearly, and after any change
a post-mortem for every real use: planned drill, actual emergency or suspected misuse	head of IT and the security contact	after each use

basis practice. The 90-day rhythm is Microsoft's; the rest is your choice.

the controls and rules it serves

privileged accessThe accounts are the most privileged in the tenant, so how they are held, watched and tested is the control.
logging and monitoringEvery sign-in raises an alert, and the sign-in and audit logs are kept for the review that follows.
multi-factor authenticationThe accounts use a phishing-resistant method that differs from the one your administrators use.

This page describes what the platform's maker documents for this one platform. It does not say the platform is the right choice for your company, and the same control exists elsewhere.

check it yourself

Microsoft Learn: Manage emergency access admin accounts, Microsoft Entra ID (page dated 4 June 2026, read on 2 November 2026)

your next step

Check today whether you have two emergency accounts that signed in successfully in the last 90 days.

read the sign-in baseline page