Here’s the short version: a Microsoft 365 break-glass account is an emergency Global Admin you can still use when Conditional Access, MFA, or your IdP has a bad day. It is excluded on purpose. It is monitored on purpose. It is never Outlook.
Microsoft documents emergency access accounts. Entra role best practices tell you not to live in Global Admin. Those two pages are the pair: few standing admins, plus a door that still opens.
If you just rolled Conditional Access or passkeys, and you do not have break-glass, you built a lock with no spare key. That is not toughness. That is a future outage.
Why you need a break-glass account even in a 15-person firm
Conditional Access can block the whole tenant if a bad policy hits all users, all apps, all conditions. Identity providers have incidents. Phones die. The person who knows the Authenticator seed is on a plane.
A small firm is more fragile, not less. There is no 24/7 identity team. There is you, a help desk, and a policy you clicked last quarter.
Microsoft’s emergency-access article is written for enterprises. The SMB version is the same physics with fewer people: two cloud accounts, stored where a policy outage cannot reach, alerted on every sign-in.
If you only have one Global Admin and it is the owner’s daily mailbox, a CA mistake plus a dead phone is a vendor emergency. Break-glass is how that week stays a 20-minute fix.
What the account is
Cloud-only. Not synced from on-prem, so a directory problem cannot take it down. If you still run hybrid, that is the point: the emergency account must not depend on the sync engine you might be there to repair.
Global Admin, because the point is to fix CA and roles. Microsoft lists privileged roles so you can see why GA is the nuclear option. You can debate a second account with less privilege. In a small tenant, two cloud Global Admins used only for emergencies is the usual pattern.
Not licensed for mail if you can avoid it. Nobody should email breakglass@. Nobody should Teams it. The sign-in is the only job.
Name them so they are obvious in logs (emergency-a@contoso.com, not jen@). Obvious names make alerting and audits possible. Cute names make them look like people.
Use a cloud UPN that does not depend on your public DNS if you can. If the emergency is “someone broke the domain” or “the registrar lock expired,” emergency-a@tenant.onmicrosoft.com still signs in. Custom-domain UPNs are fine when DNS is healthy. DNS is not always healthy on the day you need the door.
Stored offline: printed in a safe, or a vault that two people can open, not the same 1Password everyone uses for shopping. Split knowledge if you are serious: one person has the username location, another has the envelope.
Exclusions and alerts
Exclude the accounts from Conditional Access carefully. Microsoft’s users and groups in CA docs are where exclusions live. Exclude from the policies that could lock the tenant, not from logging. If you exclude them from everything including audit, you have invented an invisible admin.
Alert on every successful and failed sign-in. Use Entra sign-in logs as the source, then a mail or Teams ping to a mailbox that is not the emergency account. Test the alert the day you create the account. A silent break-glass is how insiders and attackers both win.
Review the account quarterly: still excluded, still alerts, still in the safe, password or key still known to the two people who should know. If one of those people left, you already failed offboarding.
Do not hide the accounts from the GA list in your head. They are Global Admins. Treat the count honestly on questionnaires: two standing humans plus two emergency accounts is a sentence. “We have a backup admin” is not.
Password vs key on the emergency account
Microsoft’s emergency-access article is the living document. The current recommendation is a passwordless method that satisfies mandatory MFA: passkey / FIDO2 first, certificate-based auth if you already have PKI. A long password in an envelope is the older pattern. Do not put the key on the owner’s personal laptop and call that break-glass.
If you still use passwords, length and uniqueness matter more than a quarterly forced change that gets written on the envelope in pencil. If you use keys, buy two and store them apart. If you use both accounts, do not give them identical methods in the same drawer.
Document the sign-in URL. Under stress people go to the wrong portal. The incident sheet gets the URL, the account names, who can open the envelope, and who to call after.
PIM is not a substitute for break-glass. PIM is how daily admins elevate. Break-glass is how you get in when PIM, CA, or the MFA service is the outage. If you have PIM, still keep emergency accounts. If you do not have PIM, still keep emergency accounts. Global Admin hygiene is the companion post for standing privilege.
How to use it (rarely)
- Something is actually wrong: CA lockout, MFA provider outage, or you cannot reach Entra any other way.
- Sign in. Fix the policy or restore access.
- Sign out. Rotate the credential if it might have been exposed.
- Write down why you used it. If you cannot write a sentence, it was not an emergency.
Using it to “save time” on a Thursday admin task is how the account becomes the only admin anyone remembers.
Daily admin should follow Entra role best practices: least privilege, PIM if you have it, separate accounts for email and admin.
A two-hour build
Hour 1: create two cloud accounts
FIDO2 keys stored offline if you can. No mail. Names that log cleanly. Cloud-only UPNs.
Hour 1.5: exclude and alert
CA exclusions. Sign-in alert to a mailbox that is not the emergency account. Send a test sign-in. Confirm someone gets the ping.
Hour 2: store and tell two people
Safe or dual-control vault. Write who can open it. Put the procedure next to the incident response contact sheet.
A tenant we reviewed had one Global Admin: the owner’s daily mailbox, Authenticator on one phone, no emergency account. We created two cloud emergency GAs, stored one envelope with the owner and one with the office manager, excluded them from CA, and sent a test sign-in. The alert hit the help-desk mailbox. We put the procedure on the incident sheet. A month later a CA change misfired for guest access. They used emergency-a, fixed the policy, rotated the password, and wrote three sentences. That is a successful break-glass event. Boring is the goal.
If the envelope had been in the owner’s backpack with the phone, the same week would have been a vendor emergency instead of a 20-minute fix.
Common failures
One account, one phone. The phone is the outage.
Same vault as daily passwords. The vault outage is the outage.
No alert. You will learn it was used from the attacker.
Excluded from audit logs. Then it is a ghost.
Never tested. The password in the envelope is from 2021 and was rotated in a forgotten drill.
Synced from on-prem. Then AD is the outage.
Put break-glass on the incident response tabletop list. Scenario: CA locks the tenant. Who opens the envelope. Who signs in. Who fixes the policy. Who rotates the password after. If the room cannot answer without looking at a phone that would also be locked out, the design failed.
Call the people who can open the safe. If one left the company, you already have an incident, you just have not named it.
Cybersecurity for Microsoft 365 includes a door you can still open.
“Two cloud emergency Global Admins, excluded from Conditional Access, stored dual-control, alert on any sign-in, tested [date]” is the sentence for an insurer or a client questionnaire. “We have a backup admin” is not. Date the last test. If you cannot name the date, you have not tested.
Printable break-glass checklist
- Create two cloud-only emergency Global Admins. No mail.
- Store credentials dual-control, not in the daily vault.
- Exclude from CA policies that could lock the tenant. Do not exclude from logs.
- Alert on every sign-in, success and failure.
- Test sign-in. Confirm the alert arrives.
- Put URL, names, and who can open the envelope on the incident sheet.
- Tabletop the lockout scenario once.
- Review when staff change. If an envelope-holder left, replace them this week.
- After any real use: rotate, write three sentences, sign out.
- Quarterly: still excluded, still alerting, still in the safe.
If step 5 fails, you have a secret admin, not a door. Fix the alert before you need the door.
If you want two emergency accounts built, excluded, and actually alerting, contact Secure Techies. We work from Canoga Park. We will not let the only Global Admin live on one person’s Authenticator. Bring whoever currently holds GA. That meeting is shorter if they already have a second account for mail.
Frequently Asked Questions
