What Is a Break Glass Account?

What a break glass account is

The name comes from the fire alarm behind glass: you only use it in an emergency. In Microsoft 365, it's a separate account that holds the Global Administrator role, the highest level of control over your tenant. It isn't anyone's everyday login, and it isn't used for routine admin work. Microsoft recommends keeping two or more of them so that one problem can't take out every route back in.

Why your business should own one

Most days, your admins and your IT provider sign in with their own named accounts. A break glass account covers the days that doesn't work:

• Sign-in or MFA problems. An authentication outage, a lost or replaced phone, or a sign-in rule that was set up wrong can keep every regular admin out at once.
• The last admin leaves. If the only person with top-level rights leaves or their account is disabled, nobody may be able to make changes.
• Your MSP relationship ends. When you change providers, you shouldn't depend on the outgoing provider to let you into your own tenant.
• Your provider's access fails. If your provider's connection to your tenant breaks, is removed or has to be shut off during a security incident, you still have a way in.

It's the tenant equivalent of keeping a spare key to your own building instead of leaving the only one with the alarm company.

Best practices for setting one up

These follow Microsoft's public guidance on managing emergency access accounts:

• Keep at least two. One spare can fail; two gives you redundancy.
• Make them cloud-only. Use your tenant's built-in onmicrosoft.com address, not an account synced from an office server or tied to an outside sign-in service, so an outage elsewhere doesn't take them down too.
• Protect them with phishing-resistant MFA. Microsoft recommends a passkey on a FIDO2 security key, or certificate-based sign-in, using a different method from your everyday admin accounts.
• Keep them out of normal sign-in paths. Exclude them from sign-in policies that could block or restrict them during an emergency, and don't tie them to any one person's phone or device. The strong MFA is what protects them.
• Store the credentials securely offline. Keep keys and recovery details in secure, separate locations, such as a safe, or split them so no single person holds everything. Only authorized people should know where they are.
• Alert on any sign-in. Every use of a break glass account should notify your administrators right away, and each use should be reviewed afterward.
• Test them regularly. Confirm the accounts still sign in and the alerts fire at least every 90 days, and again whenever the people who hold the credentials change.

Blue Tree Technology®'s policy

When a client asks, Blue Tree Technology® creates a Break Glass Account for them. We'll talk through where the credentials should be kept and who at your firm should be able to use them, so your business keeps control of its own tenant.

How it fits with your provider's access

A break glass account doesn't replace your IT provider's day-to-day admin access. It supports your control of the tenant if that access is ever unavailable. Our article on how MSP administrative access is secured covers how provider access should be limited and logged, and Can Our IT Provider Read Our Email? explains when a provider should open a mailbox.

Related Blue Tree Technology® pages

• Can You Trust an MSP With Administrative Access?
• Can Our IT Provider Read Our Email?
• Leaving an IT Provider: Who Controls Your Accounts, Documentation, and Access?
• Passkeys Explained: Why They Are Safer Than Passwords

Still have a question?

Ask Little Sprout, the assistant on our website, for general information. To talk through emergency admin access for your tenant, schedule a free 15-minute discovery call.