Break-glass account storage and testing

Overview

Emergency Global Administrator accounts must exist but never day-to-day use. Follow Microsoft’s break-glass guidance for your stack.

Implementation

1. Create two cloud-only accounts with complex passwords generated by vault; no MFA tied to same device as admins (FIDO backup card in physical safe optional).
2. Exclude from Conditional Access policies only via dedicated break-glass group—document in runbook.
3. Store credentials in split physical or PM vault entries requiring two-person integrity where policy demands.

Testing

Quarterly log-only login test to verify accounts work; rotate password after test or use one-time access workflow.

Auditing

Alert on any break-glass sign-in—page security immediately.