Simple definition
A Break Glass Account is an emergency administrative account designed to recover control of a Microsoft Entra tenant when normal administrator accounts can no longer sign in.
Technical definition
Microsoft refers to these as emergency access accounts. They should remain independent from the authentication paths that might fail at the same time as normal admin accounts. Current guidance recommends at least two cloud-only, highly privileged emergency accounts, protected with phishing-resistant authentication and monitored so any use is detected.
What is it used for?
Prevent a complete administrative lockout caused by federation outages, MFA failures, Conditional Access mistakes, or unavailable normal administrators.
Practical example
A misconfigured Conditional Access policy blocks every normal administrator. An emergency account kept outside the failed authentication path can still sign in and repair the policy.
Common issues
- Emergency account accidentally targeted by a blocking Conditional Access policy
- Emergency credentials or authentication method expired or unavailable
- Account used for routine administration instead of emergencies
- No alerting or periodic validation of the account
Key takeaway: A Break Glass Account should be tested, monitored, and reserved for emergencies; it should never become a day-to-day admin account.