Introduction
Break glass accounts are your emergency lifeline, providing privileged access when the identity system fails and no one can sign in to access organisation resources due to outages, breaches, lockouts, or misconfiguration. These accounts are critical for maintaining control and continuity but must be tightly secured, rarely used, and continuously monitored.
⚠️ Why They Matter
Aside from incidents stemming from a cyber-attack that results in an outage, standard users may be denied access to the organisation’s resources when conditional access misfires or directory sync fails, and even privileged users can be locked out. Break glass accounts offer a secure fallback when global admin roles are deleted or disabled, ensuring access during high-impact incidents.
Best Practices for Securing Your Microsoft 365 Break Glass Accounts
Securing and maintaining your break glass accounts in a Microsoft environment should typically revolve around the following areas. It’s worth noting that some of these points also apply outside of the Microsoft 365 environment.
Strategic Account Creation 👥
- Limit your break glass accounts to three cloud-native accounts per tenant for redundancy:
Having an extra break-glass account might increase your attack surface.
- Use non-obvious naming conventions to conceal the purpose of the account:
Avoid obvious account names like (Breakglass, Admin).
- If you have password expiration configured, ensure your break glass account password is set never to expire: Update-MgUser -UserId <user ID> -PasswordPolicies DisablePasswordExpiration (to set an account password never to expire):
This ensures you always have access to your tenant during emergencies.
- If Privileged Identity Management (PIM) is utilised to manage role assignment within your organisation, assign permanent global admin roles via PIM.
Do not set the role assignment to be eligible for your emergency access accounts.
- Keep accounts isolated from user groups, mailboxes, and collaboration tools.
Business tools such as Teams, SharePoint or OneDrive to minimise attack surface and exposure to phishing and spam.
- Avoid dual-purpose accounts
Break glass accounts should be used exclusively for emergency access, not daily administrative tasks.
Robust Authentication 🦍
- Use distinct authentication methods (e.g., FIDO2 keys) across all accounts.
- Register multiple sign-in methods to prevent lockouts.
✅Recommended MFA options:
-
- FIDO2 Security Keys – phishing-resistant, hardware-based.
- Certificate-Based Authentication (CBA) – secure and enterprise-grade (PKI infrastructure required).
- Configure long, complex passwords (25+ characters).
This ensures maximum protection against brute force attacks.
Secure Credential Storage 💾
- Store physical tokens in fireproof safes, accessible only to authorised personnel.
Passwords should be stored appropriately as well.
Logging & Monitoring 🧾
- Configure high-priority alerts for any break glass account usage.
This ensures notifications for suspicious behaviour and that these accounts are exclusively used for emergency access.
- Review audit logs regularly for anomalies and unauthorised access.
Always check the Microsoft Entra audit logs for anomalies.
- Configure risk-based sign-in policies to flag unusual patterns.
See configure and enable risk policies.
Regular Testing & Validation 🧪
- Test access every 30–90 days to ensure functionality, conditional access exclusions, and MFA settings.
This ensures administrators can successfully sign in when needed and secure storage of the authentication token.
- Verify alert notifications during tests.
Simulate outage scenarios to validate real-world readiness.
Geo-Fencing and IP Restrictions 🌐
Where feasible, restrict Break glass account sign-ins to trusted IP ranges or geolocations using conditional access.
Monitor sign-ins from anomalous regions and configure alerts.
Lifecycle Management and Rotation ♻
- Periodically rotate credentials and authentication devices to reduce long-term exposure.
Always validate that retired personnel or contractors can no longer access break glass credentials or devices.
Final Thoughts 🔚
Well-managed break glass accounts are the cornerstone of resilient identity governance. It’s your guaranteed way to maintain control when everything else fails, protecting your business when it matters most. As security admins configuring layered authentication, operational discipline, and automated oversight, you ensure these accounts remain secure, available, and effective when everything else fails.
Using these best practices as a guide with Microsoft’s official guidance on emergency access accounts, you can ensure secure, last-resort access during emergencies, ensuring business continuity and control.