Set up two emergency access (break-glass) accounts in Microsoft Entra ID

An emergency access account, often called a break-glass account, is a spare Global Administrator you only use when normal admin sign-in fails: a Conditional Access policy locks everyone out, an MFA service is down, or the only admin has left. Microsoft recommends at least two. This guide creates them the way Microsoft's current guidance describes, protects them with a passkey, keeps them out of blocking Conditional Access policies and sets up an alert for when they are used.

Before you start

• You need Privileged Role Administrator (or Global Administrator) to assign the role, User Administrator to create users, Authentication Policy Administrator for passkey settings and Conditional Access Administrator for policies.
• Get two FIDO2 security keys per account if you can, so you have a spare. Microsoft recommends a passkey (FIDO2) or certificate-based authentication for these accounts.
• Agree where the keys will be stored. Microsoft suggests secure, fireproof safes in separate locations, available to more than one member of the admin team.

Step 1: Create the two accounts

1. Go to entra.microsoft.com and sign in as at least a User Administrator.
2. Browse to Entra ID > Users.
3. Select New user > Create new user.
4. On the Basics tab, in User principal name, type a neutral name such as ea01 and pick your yourtenant.onmicrosoft.com domain from the list after the @. Avoid names like "breakglass" or "admin" that make the account an obvious target.
5. Set Display name to the same, for example EA01.
6. Untick Auto-generate password and enter a long, random password. Leave Account enabled ticked.
7. Select Review + create, check the details, then select Create.
8. Repeat for the second account, for example ea02.

Step 2: Give them Global Administrator, permanently

1. Browse to Entra ID > Roles & admins. On older menus this is under Identity.
2. Select the name Global Administrator to open it. Don't just tick the box next to it.
3. Select Add assignments, pick EA01 and EA02, then select Add.
4. If you have Microsoft Entra ID P2 and Privileged Identity Management, you'll see extra options. Choose an Active assignment that is Permanently assigned. Microsoft says these accounts must be active permanent, not eligible, so they don't depend on PIM working in an emergency.

Step 3: Make sure passkeys are allowed

1. Browse to Entra ID > Security > Authentication methods > Policies.
2. Select Passkey (FIDO2).
3. On Enable and Target, make sure it is enabled for a group that includes your two accounts, or for All users.
4. On Configure, check Allow self-service set up is Yes, then select Save.

Step 4: Register a security key on each account

1. On a secure admin machine, open a private browser window and go to mysignins.microsoft.com/security-info.
2. Sign in as EA01 with its password. Microsoft requires an MFA sign-in in the last five minutes before you can register a passkey, so you may be prompted to set up a first method. Follow the prompts, but don't tie the account to anyone's personal phone.
3. Select Add sign-in method, choose the passkey or security key option, and follow the prompts to register the first FIDO2 key.
4. Register the spare key the same way, then sign out.
5. Repeat for EA02 with its own keys.

Step 5: Exclude them from blocking Conditional Access policies

1. Browse to Entra ID > Groups > All groups > New group.
2. Set Group type to Security, name it something like EmergencyAccess, add EA01 and EA02 as members, then select Create.
3. Browse to Entra ID > Conditional Access > Policies.
4. Open each policy that is On and blocks or restricts sign-in. Under Users > Exclude, select Users and groups, add EmergencyAccess, then select Save.
5. Report-only policies don't block anything, so Microsoft says they don't need the exclusion.

Step 6: Alert when they are used

This needs your Entra sign-in logs sent to a Log Analytics workspace in Azure Monitor. If you don't have that, at least check the sign-in logs for these accounts every week.

1. In the Entra admin center, open each account under Entra ID > Users and copy its Object ID.
2. In the Azure portal, open Monitor > Alerts > + Create > Alert rule.
3. For Scope, select your Log Analytics workspace, then Apply.
4. Under Condition, set Signal name to Custom log search, Query type to Aggregated logs, and paste the query below with your two Object IDs.
5. Set the threshold to Static, Greater than, 0.
6. Under Actions, choose or create an action group that emails and texts your admin team.
7. Under Details, set Severity to 0 - Critical, name the rule, and make sure Enable upon creation is ticked under Advanced options. Then create it.

SigninLogs
| where UserId == "OBJECT-ID-OF-EA01" or UserId == "OBJECT-ID-OF-EA02"
| project TimeGenerated, UserPrincipalName, UserId, IPAddress, ResultType, ResultDescription

Check it worked

1. In Roles & admins > Global Administrator, both accounts appear as assignments, and if you have PIM, they show as active, not eligible.
2. Tell your team you are testing, then sign in as EA01 in a private window using the security key. You should reach the admin center without being blocked.
3. Within your alert's evaluation period you should get the alert email or text. If you don't, check the action group and that sign-in logs are reaching the workspace.
4. Repeat for EA02. Write down the date and put the next test in the diary. Microsoft says to validate at least every 90 days, and after staff changes.

Sources

• Microsoft Learn: Manage emergency access admin accounts in Microsoft Entra ID
• Microsoft Learn: How to create, invite and delete users
• Microsoft Learn: Assign Microsoft Entra roles
• Microsoft Learn: Enable passkeys (FIDO2) for your organisation