Keep an emergency admin account, and lock it away
If your single sign-on or MFA breaks, you need a way back in. A break-glass account is that way, if it’s protected properly.
Most companies now log in to everything through one identity provider with MFA. Good. Now imagine the provider is down, your MFA app is broken, or the only admin is on a plane. Who can get in?
A break-glass account is an emergency admin account kept for exactly that moment.
- Create one or two, not tied to any person’s name or daily mailbox.
- Protect them with hardware security keys, stored in a safe, with a second key somewhere else.
- Exclude them from rules that could lock everyone out, such as a broken conditional access policy, but nothing more.
- Alert on every single sign-in. Nobody should ever use it quietly.
- Test it twice a year, then check the alert fired.
An emergency account nobody can find, or anybody can use, is worse than none.