Architecture
Break-glass accounts: the control everyone has and nobody tests
Two emergency accounts excluded from every policy. How to build them so they work when you need them, and monitor them so they are not a back door.
Microsoft
Why they exist
Conditional Access can lock you out of your own tenant. A misconfigured policy, an expired certificate on your federation service, an outage at your MFA provider: all of these have locked organisations out of the administrative plane of their own environment.
Break-glass accounts are the answer. They are excluded from Conditional Access so that no policy change can strand you, which also makes them the most dangerous accounts in the tenant.
How to build them properly
Two, not one
One account has a single point of failure, which is the account. Two, created separately, stored separately.
Cloud-only, no federation, no phone
They must not depend on anything that can break. That means no on-premises dependency, and no method tied to a device or a mobile number that can be lost or re-issued.
Long random passwords, split and stored offline
Printed, sealed, in two separate physical locations. A break-glass credential in the password manager fails the moment single sign-on is what broke.
Alert on every single sign-in
These accounts should sign in almost never. Any authentication is either a planned test or an incident, and both warrant somebody being paged.
Test them on a schedule
Twice a year, sign in with both, confirm they still hold Global Administrator, and reseal. An untested break-glass account is a belief.
The failure nobody expects
The most common break-glass failure is not a forgotten password. It is that somebody tidied up privileged roles, the break-glass accounts no longer hold Global Administrator, and nobody noticed because nobody had signed in for two years. The scheduled test is what catches this.
The verdict
Two cloud-only accounts, excluded, alerted, tested twice a year
It costs nothing, it takes an hour to set up, and it is the difference between a bad afternoon and a support case measured in days.
Do not exclude a named person's admin account instead. A break-glass account belongs to the organisation, not to whoever happens to be senior.
Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.