An emergency access account, often called a break glass account, is a cloud-only Microsoft Entra ID account that holds the Global Administrator role permanently, is excluded from the Conditional Access policies that could lock it out, and is used only when normal administrative access has failed.
Why it matters to a lean team
On a one to five person team, the admin who can fix an outage is often the person the outage locks out. Microsoft's reasons for keeping an emergency account are concrete: a federation or identity provider outage, MFA devices or the MFA service being unavailable, the last Global Administrator leaving, a natural disaster, or a PIM lockout where every Global Administrator and Privileged Role Administrator assignment is eligible with approval required and no active approver exists. Entra ID will not let you delete the last Global Administrator, but it does not stop that account being deleted or disabled on-premises, so a synchronized admin is not a safety net.
How it shows up in Microsoft Entra ID
An emergency access account looks like any other member user, so it has to be labelled and tracked on purpose. Microsoft's guidance gives it a recognisable shape:
- A cloud-only user on the tenant's
*.onmicrosoft.comdomain, never federated or synchronized from on-premises. - A permanent assignment of the Global Administrator role. In Privileged Identity Management it is permanent active, not eligible.
- Membership of a dedicated security group, such as one named EmergencyAccess, excluded from every Conditional Access policy that blocks or restricts sign-in. Report-only policies need no exclusion.
- A passwordless, phishing-resistant credential that differs from what regular administrators use: Microsoft recommends a passkey (FIDO2), with certificate-based authentication as the alternative where a PKI exists.
- Monitored sign-in and audit log activity, with an alert on every use so each sign-in can be confirmed as a test or a real emergency.
These accounts count toward the tenant's Global Administrator total, so they belong in every privileged inventory you keep. See how many Global Administrators a tenant should have for how two or more emergency accounts fit inside the fewer-than-five target.
What to do about it
- Create two or more accounts, cloud-only, permanently assigned Global Administrator.
- Tie them to no individual. Store the credentials in secure, fireproof safes in separate locations, known only to authorized people. For per-person accountability, Microsoft's alternative is one emergency account per administrator.
- Make sure the credential or device never expires and never falls inside an automated cleanup for inactivity.
- Use them only from a designated secure workstation or Privileged Access Workstation, and keep cloud emergency access independent of on-premises emergency access.
- Test sign-in at least every 90 days, after any IT staff change such as a termination or role move, and against the current Conditional Access configuration at least quarterly.
- After any use, run a post-mortem to confirm the use was authorized and the actions appropriate.
The full walkthrough is in Entra break glass account best practices.
Where Orbitra fits
Orbitra's identity graph shows every account that holds Global Administrator, so your emergency accounts appear beside the day-to-day admins in the same privileged inventory and in the count you show an insurer or auditor. Orbitra does not keep a protected list of accounts that response actions skip. Instead, every proposed response shows the account and what it can reach, and Orbitra tells you which steps are permanent. In Recommend mode, your team executes the response; in Approve mode, a named person signs off before Orbitra executes.
Related terms
- Global Administrator
- Privileged Role Administrator
- PIM eligible assignment
- Identity blast radius
- Privileged identity response
- Containment verification
Browse the full glossary, or read what to do when an Entra admin account is compromised, the situation where the emergency account is your way back in.
Sources
- Manage emergency access admin accounts in Microsoft Entra ID (Microsoft Learn, checked September 2026)
- Best practices for Microsoft Entra roles (Microsoft Learn, checked September 2026)