If every administrator in your Microsoft 365 tenant is locked out at once, who gets you back in?
It happens more often than you'd think. A Conditional Access rule that blocks more than intended. A lost phone holding the only authenticator app. An admin who has left the business. An outage at the identity provider your admins sign in through. Microsoft's answer is emergency access accounts, sometimes called break-glass accounts, and its guidance is that every organisation should have at least two.
What they are
Emergency access accounts are cloud-only Global Administrator accounts in Microsoft Entra, the service that controls Microsoft 365 sign-ins. They aren't tied to any person, aren't used day to day, and exist purely to get you back in when the normal admin accounts can't.
How they should be set up
- Cloud-only. Created on your
.onmicrosoft.comdomain, not synced from on-premises Active Directory, so an AD problem can't take them down with it. - A different sign-in method. FIDO2 security keys kept somewhere secure, rather than the same phones and authenticator apps your admins use every day.
- Excluded from Conditional Access. Any policy that could block sign-in must exclude these accounts, otherwise they fail in exactly the situation they exist for.
- Credentials locked away. A long, randomly generated password held in a safe or password vault, split between two people if you want extra assurance.
- Monitored. An alert on every sign-in. There should never be a surprise login on one of these accounts.
- Tested. Sign in with each account at least every 90 days, and again after any change to your sign-in policies.
Why it matters for a practice
For an architecture or engineering firm, the tenant holds the project files in SharePoint, the Teams channels, the email and the integrations into your CDE. A lockout stops drawing issue. Two properly configured emergency accounts turn a potential day of downtime into a ten-minute recovery.
We can set up and test emergency access accounts for your tenant without changing how your team signs in day to day.
Want a hand with this? Talk to us.
Source: Microsoft Learn: Manage emergency access admin accounts in Microsoft Entra ID