Break-glass account

What it is

Microsoft calls these emergency access accounts. They exist so you can’t accidentally lock yourself out of your own Microsoft 365 tenant. Microsoft gives examples of when they are needed: every admin’s MFA device is unavailable, a mobile network outage stops codes arriving, the last Global Administrator leaves, or a misconfigured policy blocks all the normal admin accounts.

Why it matters for a UK small business

Small businesses often have one or two admins. If both lose access on the same day, nobody can fix the problem from inside the tenant. As you tighten sign-in rules with MFA and Conditional Access, the chance of locking yourself out goes up, so the emergency route needs to be in place first.

How it works in Microsoft 365

Microsoft’s current guidance is:

• Create two or more emergency access accounts with the Global Administrator role
• Make them cloud-only accounts on your .onmicrosoft.com domain, not synced or federated from anywhere else
• Protect them with phishing-resistant, passwordless sign-in: a passkey on a FIDO2 security key is recommended, or certificate-based authentication if you already run that
• Use a different sign-in method from your everyday admin accounts, and don’t tie them to any one person’s phone
• Exclude them from Conditional Access policies that block or restrict sign-in, so a broken policy can’t lock them out too
• Store the credentials securely in separate locations, available to more than one authorised person
• Alert on every sign-in, and review each use afterwards
• Test them at least every 90 days, and after staff changes

If you use Privileged Identity Management, assign the role to these accounts as permanently active rather than eligible.

Microsoft now recommends passwordless methods for these accounts because they also meet its mandatory MFA requirements for admin sign-in.

How &DEV helps: the Microsoft 365 MOT sets up emergency access accounts before any sign-in policy is switched on, so tightening security never locks you out.