Break-glass account
Also known as: emergency access account, break glass account, emergency admin account
A break-glass account, also called an emergency access account, is a highly privileged administrator account set aside for emergencies, such as when a security policy accidentally locks out all admins, an MFA service fails, or an admin leaves without handing over access.
It's excluded from rules that could block it, protected with extremely strong credentials, and monitored closely. While break-glass accounts are rarely used, not having one can turn a configuration mistake into days without access to a company's systems.
Break-glass account, explained at three levels
At home
A break-glass account is like a spare house key kept in a small safe. Normally you use your everyday key, but if it breaks, gets lost or the lock jams, the spare still opens the door. A break-glass account is a spare administrator login, set up so it still works when the normal ways of signing in have failed.
At work
A break-glass account is an emergency administrator account that a business sets aside and never uses day to day. It is deliberately left out of the security rules and MFA setups that could fail or lock people out. If a bad policy change, an MFA outage or a departed admin blocks everyone else, IT signs in with it to regain control and fix the problem.
At home
A break-glass account is a spare key kept for emergencies. Normally, signing in to an organization's systems depends on several things working: the identity service, MFA apps, phones and the policies that check them. If a misconfigured policy locks out every administrator, or the MFA service fails, nobody can get in to fix it. An emergency account is deliberately set up to avoid those dependencies, so someone can still sign in and repair things.
At work
Microsoft recommends at least two cloud-only emergency accounts with the Global Administrator role, not synced from on-premises and not tied to any one person. They are excluded from Conditional Access policies that could block them. Since Microsoft began enforcing MFA for admin portals in 2024, these accounts need a strong method such as FIDO2 security keys or certificate-based authentication, with keys stored separately in secure locations and split between custodians.
At home
Families face the same problem on a smaller scale. If the one person who manages everyone's accounts, devices and passwords becomes ill or passes away, nobody else may be able to get in. Recovery codes, a shared password manager emergency access feature or Apple's Legacy Contact can serve as a break-glass account for a household. In my view, planning for emergencies like this is part of caring for people's digital lives.
At work
Protect emergency accounts with FIDO2 keys kept in separate safes, and long random passwords split between custodians. Alert on every sign-in through Entra logs or a SIEM, since normal use should be zero. Test them periodically, such as quarterly, to confirm they still work, document who can access them and how, and never use them for routine administration. Review exclusions after every Conditional Access change so a new policy does not quietly lock them out.
Real-world examples
At home
Lena printed her account recovery codes and stored them with her passport. When her phone broke, she used one to get back into her email.
At work
Jerome's Saskatoon MSP was setting up new security policies for a client when a mistake blocked all admins. Their break-glass account restored access within minutes.
How it compares
| feature | Break-glass account | Regular admin account |
|---|---|---|
| Purpose | Emergencies only | Daily administration |
| Policy exclusions | Excluded from blocking rules | Fully covered |
| Monitoring | Alert on any use | Normal logging |
| Number | Usually two | As few as practical |
Regular admin accounts run daily work. Break-glass accounts rescue you.
For analysts
In IT governance, I'd document break-glass procedures like a fire plan: who can use them, when, and how use is reviewed afterward.
History & origin
The term comes from emergency equipment behind glass, such as fire alarms, marked 'break glass in case of emergency.' Hospitals and critical industries have long used break-glass procedures for urgent access to restricted records. As cloud identity systems such as Azure Active Directory added powerful access policies in the 2010s, Microsoft began recommending that every organization keep at least two emergency access accounts. When Microsoft made MFA mandatory for Azure and admin portals from 2024, it advised protecting emergency accounts with phishing-resistant methods such as FIDO2 security keys. In my view, a break-glass account is cheap insurance against the most embarrassing kind of outage.