Break-glass admin accounts that actually work

Conditional Access, MFA, and “no standing Global Admin” are the right defaults — until the one person who knows the tenant is unavailable and every policy excludes the wrong account. Break-glass accounts exist for that day. Most SMBs either skip them or set them up once and forget the password.

This is the version that survives a real emergency.

1. Create two cloud-only emergency accounts

In Entra ID / Microsoft 365, create two dedicated admin accounts that are:

• Cloud-only (not synced from on-prem AD)
• Named obviously (breakglass1@…, emergency-admin2@…)
• Not used for daily mail, Teams, or browsing

Assign Global Administrator (or at least enough role to undo a bad Conditional Access policy). Two accounts matter: one credential can fail, get locked, or sit in a safe you cannot open tonight.

2. Exclude them from Conditional Access on purpose

Your MFA-everywhere and “block legacy auth” policies should exclude these accounts. Document that exclusion in the policy description so the next admin does not “clean it up.”

If everything requires MFA and the only Authenticator lives on a phone in a crashed car, you are locked out of your own tenant. That is the failure mode break-glass prevents.

3. Use long, unique passwords — stored offline

Generate a long random password per account. Store them:

• In a sealed envelope or password manager vault that is not tied only to the same Microsoft 365 tenant
• Separately from day-to-day IT credentials
• With a second copy for ownership / a trusted partner if that fits your risk model

Do not leave break-glass passwords in a shared Teams channel or a sticky note on a monitor.

4. Prefer password + physical control over “no MFA forever”

Microsoft’s guidance has evolved; for many tenants the practical pattern is:

• Exclude break-glass from normal Conditional Access
• Keep credentials offline and dual-controlled when possible
• Periodically test sign-in from a clean machine

Whatever you choose, write it down. Ambiguity is how emergency accounts rot.

5. Test and rotate on a calendar

Quarterly (or at least twice a year):

1. Sign in with each break-glass account from a known-good device
2. Confirm you can open the Entra admin center and edit Conditional Access
3. Confirm the accounts still have the roles you expect
4. Rotate passwords after a successful test (or after any suspected exposure)
5. Update the offline copies the same day

If nobody has signed in for eighteen months, assume the account is fiction until proven otherwise.

6. Wire them into incident and offboarding checklists

• Incident runbook: where the credentials live, who may retrieve them, who to notify
• Offboarding: if a person with break-glass knowledge leaves, rotate immediately
• Change control: any Conditional Access edit that touches exclusions needs a second pair of eyes

Bottom line

Break-glass accounts are insurance. Create two cloud-only admins, exclude them deliberately, store credentials offline, and test on a schedule — or you will discover the gap on the worst possible day.