Surviving Digital Lockouts: How (and Why) to Create a Break Glass Account in Microsoft 365 & Entra ID
Ever found yourself staring at your screen during a critical outage, helpless as your main admin account is locked by an overzealous security policy? I have – and let me tell you, nothing spikes your adrenaline quite like that moment. Today, I’m pulling back the curtain on a lesser-discussed but utterly vital trick: the break glass account. Forget the red-taped manuals — we’re talking real-world scenarios, unfiltered advice, and why your organization's survival might hinge on 15 minutes of preventive action.
Confessions of a (Formerly) Locked-Out IT Admin: Why Break Glass Accounts Matter
Let me take you back to a night I’ll never forget. It was 3 a.m., and I was jolted awake by a frantic call from my team: “We’re locked out of the admin portal!” Every IT admin dreads this scenario, but until it happens to you, it’s easy to think, “That’ll never be me.” There I was, scrambling for emergency access, realizing just how critical it is to have a safety net in place. That’s when I truly understood the value of Break Glass Accounts in Microsoft 365 and Entra ID.
What Is a Break Glass Account? (My Non-Technical Explanation)
In simple terms, a break glass account—sometimes called an Emergency Access Account—is a special admin account with top-level privileges. Think of it as the “in case of emergency, break glass” tool for your cloud environment. You don’t use it for daily work. Instead, it sits quietly in the background, ready to save the day if you ever get locked out of your main admin accounts.
The Philosophy: Safety Nets and Second Chances
Why go through the trouble of setting up a break glass account? It’s all about having a safety net. Even the most experienced admins can make mistakes—misconfigured security policies, lost MFA devices, or even a sudden admin resignation can leave you stranded. A break glass account gives you a second chance, a way to regain control when all else fails.
When Break Glass Accounts Save the Day
Admin resignations: When a key admin leaves suddenly and access is lost.
MFA device loss: If your only admin loses their phone or hardware token.
Misapplied security policies: Accidentally locking everyone out with a new policy.
Device theft or vacation mishaps: Losing access while traveling or after a theft.
These aren’t just hypothetical scenarios—they’re real-world problems I’ve seen (and experienced) firsthand.
Industry Data: Lockouts on the Rise
Research shows that admin lockouts in cloud environments are becoming more frequent. As organizations add more security layers—like Conditional Access and MFA—the risk of accidental lockout increases. Typical causes include:
Policy misconfigurations
MFA issues
Role removals
The impact? Downtime, lost productivity, and sometimes, costly recovery efforts.
Is It Worth the Worry?
Absolutely. Even seasoned pros make Admin Lockout Prevention their number one rule. As I learned the hard way, it’s not about if you’ll need a break glass account—it’s about when. As one industry expert put it:
"Break glass accounts are your last line of defense against total administrative lockout in M365 environments."
In the world of Cloud Security and Incident Response, being prepared isn’t just smart—it’s essential.
Disaster-Proofing Step-by-Step: Creating a Break Glass Account in Microsoft 365 & Entra ID
When it comes to emergency admin account setup in Microsoft 365 and Entra ID, preparation is everything. If you’re thinking, “Do I really need a break glass account?”—the answer is yes. It’s not a matter of if you’ll need one, but when. Lockouts and unforeseen issues happen, and having a break glass account ready is your safety net. Let’s walk through the process step by step, blending best practices with real-world insights and a few hard-learned lessons.
Preparation: When (Not If) to Set One Up
Research shows that organizations without a break glass account are at higher risk of being locked out during incidents or misconfigurations. Setting up this account before you need it is critical. Don’t wait for a crisis to realize you’re unprepared.
Best Practice: Use a Cloud-Only, Unlicensed Account on .onmicrosoft.com Domain
For maximum security, create your break glass account as cloud-only—don’t sync it from on-premises Active Directory. Assign no licenses. This minimizes your attack surface and avoids unnecessary exposure. Always use the default .onmicrosoft.com domain. Why? Attackers often target your primary domain first. By using the tenant’s default domain, you make the account less discoverable.
Naming Conventions: How NOT to Tip Off Hackers
This is where many admins slip up. Never name your account something obvious like breakglass@company.com or emergencyadmin@domain.com. Hackers know to look for these. Instead, as I always say,
"Give it some kind of obscure name that will have meaning to you."
For example, use a random string or a personal reference only your team understands. In one of my favorite demos, I simply usedBGA—but in production, I’d go even more obscure.
Practical Walkthrough: Creating the Account
Navigate to All Users in Microsoft Entra ID or Microsoft 365 admin center.
Click New User. Choose whether to make it an internal member or a guest (either works, but member is typical).
Set the username using your chosen obscure naming convention.
Select the .onmicrosoft.com domain.
Do not assign any licenses.
Set a usage location (e.g., US) for auditing and compliance.
Assigning Roles: What to Assign (and What Not To)
Assign only the roles necessary for emergency recovery. Typically, this means:
Global Administrator
Security Administrator
Compliance Administrator
Don’t assign unnecessary roles. Less is more—each additional privilege increases risk.
Bulletproof Passwords: Human Memory vs. Secure Random Strings
When prompted for a password, never use auto-generated or simple passwords. Create a long, complex password with uppercase, lowercase, numbers, and symbols. For memorability, some admins use a collection of random words, but always prioritize security. Store the password securely—don’t rely on memory alone.
By following these steps, you’re not just ticking a box—you’re building real resilience into your Microsoft 365 and Entra ID environment. Remember, subtlety and security go hand in hand. The less obvious your break glass account, the better your odds of staying one step ahead of attackers.
Mastering the Art of Passwords and Secure Storage
When it comes to creating a Break Glass Account in Microsoft 365 or Entra ID, password security isn’t just a best practice—it’s a lifeline. I’ve seen firsthand how a weak password can unravel even the most robust security setups. So, let’s talk about why complex passwords are non-negotiable and how to craft them for true resilience.
Why ‘StarTrek123!’ Won’t Cut It: The Case for Complex Passwords
It’s tempting to use something memorable, maybe a favorite show or a pet’s name. But research shows that passwords tied to pop culture or organizational details are prime targets for Password Spray Attacks. Attackers know the patterns—birthdays, sports teams, sci-fi references. That’s why ‘StarTrek123!’ is out. Complexity isn’t just about length; it’s about unpredictability.
Building a Password Straight Out of a Spy Novel
Here’s my go-to secure password creation tip: use a collection of random words. Not gibberish, not a phrase from your company’s mission statement, but truly unrelated words. For example, giraffe-planet-violin-42!Q. As I often say,
"A collection of random words, for example, would make a good kind of break glass account."
This approach outperforms complex gibberish for both recall and security. Aim for at least 16 characters, mixing uppercase, lowercase, numbers, and symbols. Think of it as building a password that would stump even the cleverest spy.
Team-Based Password Generation: Harnessing Collective Randomness
If you have a team of admins, blend your collective creativity. Each admin can contribute a random word or two. This not only increases randomness but also ensures no single person holds the full key. Just make sure the final passphrase doesn’t accidentally reference anything internal or obvious.
Stashing the Keys: Where (Not) to Store Break Glass Account Passwords
Now, about secure credential storage. Password managers are great for daily use, but break glass accounts require something extra. Think offline: a physical safe, an offline vault, or even a hardware security module. Never store these passwords in shared drives, email drafts, or sticky notes. The goal is to keep the password accessible only to those who need it, and only when it’s truly needed.
Tracking Usage: Monitoring and Monthly Checks
Even the strongest password is useless if you don’t know who’s using it. Regularly review audit logs for your break glass accounts. Look for unexpected sign-ins, especially outside of emergencies. Monthly checks are a must—research indicates that password complexity and storage are weak spots for most admin teams, so vigilance is key.
What If You Forget Your Own Emergency Password?
It happens. That’s why redundancy matters. Store backup copies in separate secure locations, and consider having at least two break glass accounts. If all else fails, having a documented, secure recovery process is your safety net.
Dancing Around Conditional Access: Policies, Exclusions, and Risks
Conditional Access Policies are a double-edged sword in Microsoft Entra ID and Microsoft 365. On one hand, they’re your best friend for enforcing security—think Multi-factor Authentication (MFA), device compliance, and location-based restrictions. On the other, if you’re not careful, they can lock you (and every admin) out of your own environment at the worst possible moment. Research shows that over 34% of lockouts are traced to poorly scoped access policies. That’s not just a statistic—it’s a warning.
Conditional Access: Friend or Foe During Emergencies?
Let’s get real: Conditional Access Policies are meant to keep the bad guys out. But what happens if you’re the one on the outside, frantically trying to get back in during an emergency? That’s where Break Glass Accounts come in. These are your “in case of emergency, break glass” accounts—highly privileged, rarely used, and designed to bypass normal restrictions when all else fails.
Excluding Break Glass Accounts from MFA—Vital, but Risky
Here’s the catch: to ensure these accounts work when you need them most, you typically exclude them from certain policies, especially MFA. Why? Because if Conditional Access Policies require MFA and your only admin device is lost, you could be completely locked out. But, and it’s a big but, excluding these accounts from MFA makes them a prime target if compromised. It’s a calculated risk—one you need to manage with care.
Step-by-Step: Navigating Entra ID and Avoiding ‘All Users’ Traps
When you’re setting up exclusions in Microsoft Entra ID, you’ll see options to include or exclude users and groups. Here’s my golden rule:
"One big tip I would like to give you is never use this. Never use all users because… it can potentially, as you can see, admin accounts.”
If you select All Users or All Admins as an exclusion, you’re opening a massive hole in your security. Always specify the exact Break Glass Account object. For example, after creating your Break Glass Account and assigning it the Global Admin role, navigate to the Conditional Access policy, select Exclude, and pick only that account. Never more, never less.
Drawing the Fine Line: Protecting Your Safety Net
Think of MFA as a locked car. Your Break Glass Account is like leaving one window cracked open—not for everyday use, but so you can get in if you lose your keys. The trick is making sure only you know which window is open, and that it’s not obvious to anyone else. Use obscure account names, strong passphrases, and document every exclusion for compliance.
Risks and Industry Warnings
If you misconfigure exclusions, you risk exposing your entire network to attackers.
Conditional Access missteps can block all admin accounts, leaving you helpless in a crisis.
Always document exclusions for auditing and compliance—don’t rely on memory.
Conditional Access Policies are powerful, but they demand respect. Handle exclusions with precision, and never underestimate the risks of getting it wrong.
Testing, Maintenance, and Monitoring: The Art of Not Getting Complacent
When it comes to Managing Break Glass Accounts in Microsoft 365 and Entra ID, the biggest mistake I see is treating these emergency accounts as a “set it and forget it” safety net. It’s a comforting idea, but in reality, break glass accounts can quietly decay in the background—leaving you locked out when you need them most. Regular testing and maintenance aren’t just best practices; they’re essential for survival.
Why Your Emergency Account Isn’t ‘Set It and Forget It’
Break glass accounts are designed for those rare, critical moments when all other access fails. But here’s the catch: if you don’t test them, you can’t trust them. I’ve seen organizations discover—too late—that their emergency account expired, was locked out, or had a password that nobody remembered. As one expert put it:
"If you’re not checking your break glass account every month, you’re not ready for an emergency."
Maintenance Checklist: What to Do (and How Often)
Monthly login tests: Actually sign in, just like you would in a real emergency. Don’t be surprised if you hit an MFA prompt or a temporary error—sometimes it takes a few tries, but persistence pays off. Once you’re in, verify you have admin access, even if you see no apps (that’s normal for these accounts).
Password updates: Rotate passwords at least quarterly. Use complex, unique passwords and store them securely—never in plain text or shared email.
Audit log reviews: Weekly, check audit logs for both successful and failed sign-ins. This is a cornerstone of Audit Log Monitoring and helps you spot suspicious activity before it becomes a crisis.
Catching Suspicious Activity: What to Monitor?
Monitor every login attempt—successful or not. If you see unexpected activity, especially from unfamiliar locations or at odd hours, treat it as a red flag. Automated alerts (set up via Privileged Identity Management or similar tools) can help you react quickly. In my experience, organizations that automate these alerts are far less likely to be blindsided.
Real-Life Fail: The Account That Expired Unnoticed
I once consulted for a company that hadn’t tested their break glass account in over a year. When a lockout happened, they discovered the account had expired—and with no backup, recovery was impossible. It’s a painful lesson: neglected maintenance is the root cause of most break glass failures. In fact, research shows that 67% of “broken-glass” emergencies result from simple neglect.
Automated Alerts and Escalation Policies—Worth the Setup?
Absolutely. Setting up automated notifications for break glass account activity is a small investment that pays off big. Combine this with escalation policies so the right people are informed immediately—without tipping off potential attackers. This is a key part of Best Practices for Break Glass Accounts and ensures your Backup Accounts are always ready.
Document, Document, Document
Keep detailed records of every test, password change, and audit review. Share this documentation with your security team, but avoid making it too obvious to outsiders. Ongoing vigilance and clear documentation keep your system robust and your emergency access reliable.
The Not-So-Obvious: Human Factors, Team Coordination & Accidental Heroics
When we talk about Emergency Access Accounts in Microsoft 365 and Entra ID, it’s easy to focus on the technical side—password complexity, MFA exclusions, and strict monitoring. But, as I’ve learned from both experience and research, the real story often lies with the people behind the screens. Account Lockout Prevention isn’t just about having the right settings; it’s about building a culture and a team that knows how to respond when things go sideways.
Why Break Glass Accounts Aren’t Just Technical—They’re Organizational
Creating a break glass account is a technical task, sure. But deciding who knows about it, who can use it, and how it’s managed is an organizational challenge. Best Practices suggest documenting exactly who is authorized—usually two or three people, not just the CIO or IT director. This isn’t a “set it and forget it” situation. If only one person knows the credentials and they’re unavailable, your safety net vanishes.
Team-Based Policies: Who Knows? Who Can Use?
In my experience, transparency and secrecy must be balanced. Too many people with access, and you introduce risk. Too few, and you risk being locked out during a crisis. Documenting authorized users and distributing access judiciously is key. And don’t forget: sometimes the person who remembers the break glass account isn’t the one you’d expect. As one admin told me,
"Sometimes the person who remembers the break glass account isn’t the one you’d expect."
That’s why team-based policies matter. It’s not just about titles; it’s about trust and readiness.
Training Staff: Spotting Imposters and Suspicious Requests
Emergency credentials are a high-value target. Training your team to recognize phishing attempts or suspicious requests for break glass access is a critical part of Incident Response. I always recommend regular awareness sessions. If someone gets an out-of-the-blue request for emergency credentials, they should know to verify—every time.
Quarterly Fire Drills: Simulated Lockouts and Lessons Learned
Research shows that quarterly fire drills are the sweet spot. Simulating a lockout and walking through the recovery process uncovers gaps in both process and human factors. These drills aren’t just checkboxes—they’re real opportunities to learn. Sometimes, you’ll discover that the process is unclear, or that a key person is on vacation. That’s valuable insight you won’t get from documentation alone.
The Accidental Hero: When Junior Admins Save the Day
Let’s be honest—sometimes the person who saves the day isn’t the one you’d expect. I’ve seen junior admins step up during a surprise lockout, simply because they remembered a detail others missed. Sharing these stories, even the near-disasters, helps build a culture of engagement and learning. It’s not just about Microsoft 365 Security Best Practices; it’s about encouraging everyone to be part of the solution.
Balancing Secrecy and Transparency
Finally, finding the right balance between secrecy and transparency within your IT team is crucial. Too much secrecy breeds confusion; too much transparency can create risk. The best teams I’ve worked with document, communicate, and practice—together. That’s how you turn Emergency Access Accounts from a technical checkbox into a true business continuity asset.
Conclusion: Your New Superpower (and Next Steps)
If you’ve followed along, you now understand just how vital Break Glass Accounts are for Microsoft Entra ID and Microsoft 365 Security. Think of these emergency access accounts as your insurance policy against digital disaster. They’re not just another checkbox for compliance—they’re your last line of defense when everything else fails. In my experience, having these accounts ready and tested transforms you from a reactive IT responder into a truly proactive professional. It’s the difference between scrambling during a crisis and calmly restoring order when chaos hits.
Let’s recap what makes Break Glass Accounts so essential. They’re cloud-only, unlicensed, and use the default .onmicrosoft.com domain, which reduces the risk of federation or domain sync issues. Using obscure or randomized names instead of obvious ones like “breakglass” helps defend against password spray attacks. Strong, complex passwords are a must, and storing them securely—ideally in an offline, access-controlled vault—is non-negotiable. Assigning Global Admin privileges ensures you have the power to recover, while excluding these accounts from all Conditional Access policies prevents accidental lockouts. And remember, monitoring and auditing sign-ins is a best practice for detecting unauthorized use.
But are you truly ready? Here’s a quick self-check:
Have you created at least two Break Glass Accounts for redundancy?
Are they cloud-only and unlicensed, with strong, unique passwords?
Are these accounts excluded from all Conditional Access and MFA policies?
Is access to credentials tightly controlled and documented?
Do you regularly monitor and audit sign-in activity for these accounts?
Is your team aware of the process, and is it documented in your incident response playbooks?
If you hesitated on any of these, now is the time to act. As research shows, preparedness is what separates the IT heroes from the rest. Updating your organization’s documentation and playbooks is just as important as the technical setup. Make sure everyone on your team knows when and how to use these accounts—and just as importantly, when not to.
I can’t stress this enough: Don’t wait for a crisis to realize what you should have done. As I often say,
"The best time to set up a break glass account was yesterday. The second-best time is now."
By investing a little time today, you’re building resilience into your Microsoft 365 Security strategy. You’re not just protecting your organization—you’re stepping up as the responsible professional your team can rely on when it matters most. So, review your setup, update your documentation, and make sure your Emergency Access Accounts are ready to go. Because in IT, being prepared isn’t just best practice—it’s your new superpower.