A Microsoft 365 break glass account is a spare Global Administrator account you never use day to day. Microsoft calls it an emergency access account. It exists for one situation: every other admin is locked out of your tenant, and you need back in.
Small businesses hit that situation more often than they expect. The one person with admin rights leaves. A Conditional Access policy meant for staff ends up blocking the admins too. The phone with the Authenticator app gets lost. Without a second way in, you’re opening a support case with Microsoft and proving who you are while nobody can change anything.
Microsoft 365 admin lockout
When the everyday admin can't get in, the break glass account still can
Everyday admin account
Break glass account
Based on Microsoft's emergency access account guidance (Microsoft Learn, updated June 2026).
What Microsoft recommends
Microsoft’s guidance for emergency access accounts fits on one screen. Set up two of them, keep them simple, and make sure nothing you configure later can lock them out.
| Setting | What to do | Why |
|---|---|---|
| How many | Two accounts | If one key is lost or broken, the other still works |
| Account type | Cloud-only, on your yourcompany.onmicrosoft.com domain | Keeps working if your custom domain, federation, or directory sync breaks |
| Role | Global Administrator, assigned as active and permanent | A role that needs someone to approve it can lock you out at the worst moment |
| Sign-in method | A FIDO2 passkey on a hardware security key | Phishing-resistant, meets Microsoft's required MFA, and doesn't depend on anyone's phone |
| Conditional Access | Excluded from every policy that blocks or restricts sign-in | A bad policy is one of the main reasons you'd need the account |
| Monitoring | An alert on every sign-in | Nobody should use it without the rest of the team knowing |
| Testing | Sign in with each account at least every 90 days | Proves the key, the account, and the alert still work |
Source: Microsoft Learn, Manage emergency access accounts in Microsoft Entra ID (updated June 2026).
Use a hardware key, not a password in a drawer
Older advice said a break glass account should have a long password and no MFA (multi-factor authentication). That advice is out of date. Microsoft now requires MFA to sign in to its admin portals, so a password-only account won’t get you into the admin center when you need it.
Buy two FIDO2 security keys, one per account, and register each key only to its account. Microsoft also suggests using a different sign-in method than your everyday admins. If your admins use the Authenticator app, the emergency accounts use keys. Never register anyone’s personal phone to these accounts.
Store the keys like a spare building key
Keep the two keys in two separate places, such as the office safe and an owner’s safe at another location. Write down who is allowed to use them and the steps to follow. When someone with access to a safe leaves, change the combination.
Exclude them from blocking policies
Create a security group called something like EmergencyAccess and put both accounts in it. Then exclude that group from every Conditional Access policy that blocks or restricts sign-in, including MFA, device, and location rules. Policies in report-only mode don’t block anything, so they don’t need the exclusion.
Make this part of how you create policies. A new policy that forgets the exclusion can lock out the one account built to survive a bad policy.
Get an alert every time one signs in
A break glass sign-in should never be a surprise. Microsoft’s guidance is to send Entra sign-in logs to Azure Monitor (or Microsoft Sentinel) and create an alert that fires whenever either account signs in. Route it by email or text to everyone who should know.
Conditional Access and sign-in log exports need Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium. If you’re on a plan without it, make checking the sign-in logs for these accounts part of a monthly routine instead.
Test it every quarter
Microsoft recommends validating the accounts at least every 90 days, and again whenever someone in IT leaves or changes roles. A test should confirm four things:
- Each key signs in to its account.
- The account can do an admin task.
- The alert fired.
- The list of people allowed to use the keys is still right.
Our take: every Microsoft 365 tenant should have two break glass accounts, including a 10-person office. The setup takes an afternoon and two security keys. If you’d like a second set of eyes on your admin accounts and Conditional Access policies, that’s part of the access control work we do in cybersecurity.