Emergency access account
noun · also Break-glass account · Microsoft Learn: Manage emergency access admin accounts
A highly privileged account kept aside for emergencies, such as a misconfigured access policy or an MFA outage, so administrators can never be fully locked out.
The name comes from the "break glass in case of emergency" boxes that hold fire alarms and keys. In a cloud tenant, an emergency access account is an administrator account that nobody uses day to day. It exists for the rare moment when normal administrator accounts cannot sign in: a Conditional Access policy that blocks everyone, a federation or MFA outage, or the last administrator leaving the company.
Because these accounts are both powerful and excluded from some protections, they need special care. Microsoft recommends at least two, cloud-only, protected by phishing-resistant methods such as passkeys stored in a safe, with every sign-in raising an alert and a test at least every 90 days.
Example
An administrator turns on a new policy requiring a compliant device for all users and forgets that no administrator laptop is enrolled. Everyone is locked out. A second administrator takes the emergency account's security key from the safe, signs in, switches the policy back to report-only, and the alert from that sign-in becomes the start of the post-incident review.
Why it matters for a SOC analyst
A sign-in by an emergency access account should never be routine. Treat every one as an incident until someone confirms it was a planned test or a real emergency, and check what the account did while it was signed in. Attackers who find such an account unmonitored have the keys to the whole tenant.
Related terms
- Conditional Access
Microsoft Entra ID's policy engine that decides, at each sign-in, whether to allow access, require MFA or another control, or block.
- Phishing-resistant MFA
Authentication methods, such as passkeys, FIDO2 keys and Windows Hello for Business, that cannot be relayed or approved by a phished user.
- Least privilege
Giving every user, service and application only the access it needs to do its job, and only for as long as it needs it.
- Identity and access management
The processes and tools that manage digital identities and decide what each one can access, from account creation to removal.