Break-Glass Emergency Access Accounts in Entra: How to Set Up and Audit Them

The short version: A break-glass account (Microsoft calls it an emergency access account) is a cloud-only Global Administrator you keep for the day normal admin sign-in fails. Microsoft's guidance, last updated 4 June 2026, is to keep at least two, sign them in with a passkey (FIDO2) or certificate rather than a phone, exclude them from Conditional Access policies that block or restrict sign-in, alert on every use, and test them at least every 90 days.

Every Microsoft 365 tenant eventually has the afternoon when the admins cannot sign in. A Conditional Access policy was switched on with a typo, the phone network is down so nobody can receive the MFA prompt, or the one person who held the Global Administrator role has left. If there is no emergency account, the fix is a support call to Microsoft and a long wait. If there is one but nobody can find it, or it has been quietly disabled, the result is the same.

This guide answers the practical questions: how many accounts you need, how to set them up in 2026 now that MFA is mandatory for admin portals, what to exclude them from, how to alert on them, and how to audit the whole arrangement in half an hour. It is based on the Microsoft Learn page Manage emergency access admin accounts, which we read on 10 November 2026.

What is a break-glass account in Microsoft 365?

A break-glass account is a user account in Microsoft Entra ID with the Global Administrator role that is used only when normal administrative accounts cannot be used. Microsoft's own term is "emergency access account". It is not a spare admin account for convenience, and it is not a shared login for the IT team's daily work. It exists so that one failure, whether a bad policy, an identity provider outage or a departed administrator, cannot lock the whole organisation out of its own tenant.

Microsoft lists the situations it is designed for: federation is unavailable, administrators' MFA devices or the MFA service are unavailable, the last Global Administrator leaves, a disaster takes out mobile networks, or all privileged role assignments are eligible rather than active and nobody can approve an activation.

How many emergency access accounts do you need?

Two or more. Microsoft says to create "two or more" accounts and lists "maintain at least two emergency access accounts for redundancy" in its guardrails. Two is the right number for most small and mid-sized tenants: one can fail (a lost key, an accidental disablement) without the other going with it. More than three adds credentials to guard without adding resilience.

How many Global Administrators in total is a separate question. A small tenant can run on two or three people plus the emergency accounts. If you find ten or more standing Global Administrators during a review, that is a finding of its own, not a sign of good coverage.

How should you set up a break-glass account in 2026?

Microsoft's current steps differ from older advice, mainly because of mandatory MFA for admin portals. In outline:

1. Create the accounts as cloud-only users on the *.onmicrosoft.com domain. They must not be federated or synchronised from on-premises Active Directory.
2. Assign the Global Administrator role. In Privileged Identity Management, make the assignment active permanent, not eligible.
3. Choose a phishing-resistant sign-in method. Microsoft recommends a passkey (FIDO2); certificate-based authentication is the alternative if you already run a public key infrastructure. Both satisfy the mandatory MFA requirements.
4. Use a different method from your everyday admin accounts. If admins normally use the Authenticator app, use a hardware security key for the emergency account.
5. Do not tie the account to a person or a personal phone. Credentials should be kept where more than one authorised administrator can reach them, for example a safe in a separate location.
6. Make sure the credential does not expire and is not swept up by automated clean-up of unused accounts.

Why not just use a long password?

Older guidance told administrators to use a very long password and exclude the account from MFA. That advice has been overtaken. Microsoft's page now says a phishing-resistant method registered on the account is what protects it, and the methods it lists are the ones that satisfy the mandatory MFA enforcement. A password-only account with an MFA exclusion is exactly what an auditor, or an attacker, will look for first.

Should break-glass accounts be excluded from Conditional Access?

Yes, from the policies that block or restrict sign-in. Microsoft's reasoning is that an enforced policy requiring MFA, a compliant device or a named location can make the account unusable during the exact emergency it exists for. Two practical points:

• Create a dedicated security group, for example EmergencyAccess, and exclude that group rather than individual users. New policies then have one obvious exclusion to add.
• Report-only policies do not block access and do not need the exclusion, according to the same page.

This is where most tenants go wrong in either direction. Either the account is subject to a "require MFA for all users" policy and would fail in a real lockout, or it is excluded from everything and nobody is watching it. The exclusion is only safe when the account is strong and monitored. If you are still deciding how your policies should look, our comparison of security defaults and Conditional Access is a good starting point.

How do you monitor a break-glass account?

Every sign-in to an emergency account should raise an alert to more than one administrator. Microsoft's example sends Entra sign-in logs to Azure Monitor and creates a query-based alert on the accounts' object IDs with a threshold of greater than zero, severity 0 (critical), and an email or SMS action group. Microsoft Sentinel or another tool works as well. The principle matters more than the product: a sign-in that nobody planned must reach a human within minutes.

Two details are easy to miss. The sign-in logs have to be flowing to a workspace before the alert can fire, and the audit log must be on and retained long enough to review afterwards. Our Microsoft 365 audit log retention check explains what your licence keeps.

After any use, Microsoft recommends a short post-mortem: was it a planned drill, a real emergency, or misuse, and did the actions taken match the authorised purpose?

How do you audit your break-glass accounts?

This is the checklist we use. You can run it yourself in under an hour in the Entra admin centre.

1. Count. Are there at least two accounts, and can you name them? List Global Administrators and look for names such as breakglass, emergency or ea-.
2. Type. Are they cloud-only on onmicrosoft.com? Any sync from on-premises or federated domain is a finding.
3. Role. Is Global Administrator active permanent? An eligible assignment means the account depends on an activation that might itself be blocked.
4. Sign-in method. Is a passkey or certificate registered, and is it different from the normal admin method? A password plus a phone number registered to one person fails Microsoft's own requirements.
5. Conditional Access. For each enabled policy that blocks or restricts sign-in, is the emergency group excluded? Test with the What If tool, and remember that report-only policies need no exclusion.
6. Alerts. Is there a live alert on their sign-ins, and who receives it? Ask someone to sign in during a planned drill and see whether the alert arrives.
7. Last test. When did an authorised person last sign in and perform an admin task? Microsoft says at least every 90 days, and also after IT staff changes or subscription changes.
8. Storage. Where are the credentials, who can reach them, and were safe combinations changed after anyone with access left?
9. Hygiene. Make sure the accounts are not licensed for mail, not used for daily work and do not appear in normal sign-in reports.

What does a failing result look like?

Common findings are a single emergency account, an account that is still a synced on-premises user, an account excluded from MFA with a password only, an account that was disabled during a clean-up and never re-enabled, and an alert that goes to a mailbox that nobody reads. None of these is exotic. All of them are visible from configuration alone.

How does this relate to a full Microsoft 365 security audit?

Emergency access is one control inside the Entra ID and privileged access section of a wider review. Our Microsoft 365 CIS Benchmark audit reads the tenant's configuration through a read-only Microsoft Graph app and checks, among other things, who holds Global Administrator, how sign-in is protected for them and which Conditional Access exclusions exist. The report is designed to be used as evidence for common cyber-insurance questionnaire and Cyber Essentials questions on administrator access. It does not read mail or document content. You can see how findings are laid out in the sample report walkthrough, and the full list of areas is on the Microsoft 365 security audit service page (English page).

For broader context on who should hold administrator roles, read our explainer on Microsoft 365 and Entra ID security audits.

Frequently asked questions

What is a break-glass account in Microsoft 365?

A cloud-only Global Administrator account kept for emergencies, used only when normal admin accounts cannot sign in. Microsoft's term is emergency access account.

How many break-glass accounts should I have?

At least two, according to Microsoft's current guidance. Two gives redundancy without adding many credentials to protect.

Should break-glass accounts have MFA?

Yes, but not the same MFA as everyday admins. Microsoft recommends a passkey (FIDO2) or certificate-based authentication, which satisfy the mandatory MFA requirements without depending on a phone or an individual.

Should I exclude break-glass accounts from Conditional Access?

Exclude them from policies that block or restrict sign-in, using a dedicated group. Report-only policies do not need an exclusion. Pair the exclusion with strong credentials and alerting.

How often should I test them?

Microsoft says at least every 90 days, and after changes in IT staff or in your Entra subscriptions. A test means signing in and performing an administrative task, and confirming the alert fires.

Does a Brocent audit sign in as my emergency account?

No. The audit uses a read-only Microsoft Graph app that a Global Administrator consents to once, which takes about 15 minutes and can be removed in Entra ID. It reads configuration, not mail or document content.

Next steps

Open Entra, list your Global Administrators and tick off the nine checks above. If you would rather have an independent review of this and the rest of the tenant, see the fixed prices on the Microsoft 365 Security Audit pricing page, from US$450 for 1 to 10 users, one-time and excluding tax. To talk it through, contact us. You may also like our guide to how much a Microsoft 365 security audit costs.