Emergency accounts in Microsoft 365: what to do if the administrator gets locked out

7 min read · DataRoad

Emergency accounts in Microsoft 365 They are the company's backup key. If the only administrator is locked out — because they lost their authentication phone, because a poorly configured access rule closed the door to everyone, or because they left the company without providing their credentials — it's with these accounts that they have to log in again. Without them, recovery depends on requests to Microsoft support and proof of ownership, while email, Teams, and files are left without management.

This article explains, in management language, what they are, how many to have, where to store the keys and who should have access to them.

How a company runs out of administrators

No attack is necessary. The scenarios we see most often are banal:

• The authentication mobile phone was lost or replaced and it was the only second-factor method of the sole administrator.
• A rule of conditional access (the rules that say “only from Portugal” or “only from company computers”) were activated with an error and blocked everyone, including the person who created them.
• The administrator has left — a collaborator, or the previous IT provider — and the credentials came with it.
• The administrator account was compromised and the attacker changed the password and the authentication methods.

In all of them, the question is the same: who can get in now, without depending on the account that failed?

What Microsoft recommends

The official documentation from Microsoft about emergency access accounts in Microsoft Entra (the identity system behind Microsoft 365) is clear. We summarize the main recommendations:

Multi-factor authentication is also mandatory for these accounts.

For years, many companies kept their emergency account with just a long password in an envelope. That’s all over now. Microsoft has started requiring multi-factor authentication to access the administration portals — in the Microsoft 365 administration center, starting in February 2025 — and the documentation explicitly states that emergency accounts are also covered without exception.

The methods that Microsoft indicates to meet this requirement in these accounts are the physical security key (FIDO2) or certificate authentication. In practice, for a SME, the simplest solution is to have two physical keys for emergency use, stored in different locations. We explained the various methods in the article on MFA in the company.

Who keeps the keys

This is an administrative decision, not a technical one. We recommend a simple rule: emergency keys belong to the company, not the computer vendor.

• A key in the company's safe, With access from the administration.
• A second key in another location — another office, the safe of an administrator, or a bank safe.
• Written registration who has access to them, where they are located and when they were last tested.
• Any associated password in a Enterprise password manager, in an area restricted to the administration.

The provider manages day-to-day operations with nominal administration accounts, each technician with their own. Emergency accounts are the guarantee that the company never becomes a hostage to anyone — including us. It is also one of the clauses we recommend checking in any contract, as we explained in the article about Exit clauses and data in an information technology contract.

Checklist: are you ready?

1. Are there at least two emergency accounts on the .onmicrosoft.com domain?
2. None of them are associated with a person or a personal mobile phone?
3. Do they use a physical security key or certificate, and not SMS or an app on the phone?
4. Are they excluded from the conditional access rules that block entries?
5. The administration knows where the keys are, and they are in separate locations?
6. Does an entry into one of these accounts trigger an immediate alert?
7. Have they been tested in the last 90 days?
8. Do technicians use their own administrative accounts, rather than shared ones?

If you answered “no” or “I don’t know” to two or more of them, the risk is real. Most of the flaws we found in Email security in Microsoft 365 It begins precisely in administration.

A real case: 50 mailboxes, migration with control from the customer side

Na Union of Parishes of Massamá and Monte Abraão, At DataRoad, we migrated about 50 mailboxes to Microsoft 365 (Exchange Online), with the complete transfer of the content, the reconfiguration of workstations and mobile devices, and validation after the migration. In a public entity, the administration of the environment must remain within the entity, regardless of who provides the service.

This is the model we recommend in the Microsoft 365 environments we manage: nominal administration accounts for the technical team, emergency accounts in the client's possession, and a clear record of who has access to what.

Frequently Asked Questions

How many emergency funds should a company have?

Microsoft recommends two or more. With two, if one fails or becomes compromised, the company can still get in.

Can I use the administrator's mobile phone as a second factor?

It is not recommended. Emergency accounts should not be associated with any person or personal device. Microsoft recommends physical security key (FIDO2) or certificate authentication.

Can the emergency account only be accessed with a password?

No. Microsoft requires multifactor authentication on the administration portals and indicates that emergency accounts are also covered.

Who should keep the keys to the emergency accounts?

The company itself, in two secure and separate locations, with records of who has access. The IT provider must work with its own administrative accounts and names.

Review of your Microsoft 365 administration in 5 working days

We have verified the administration accounts, the emergency accounts, the authentication methods, and the access rules of your Microsoft 365, and we have delivered the list of priority fixes. For companies with more than 10 seats · contract of assistance · remote, local, and telephone support. Get to know our management Microsoft 365 for business and the plans IT Unlimited.

Sources

• Microsoft Learn — Manage emergency access admin accounts (Microsoft Entra ID)
• Microsoft Learn — Mandatory multifactor authentication for Azure and admin portals