Break-glass accounts in Microsoft 365: your company's insurance

Rarely a sophisticated attack. Almost always something trivial:

• Second factor lost The only administrator's phone broke, was replaced or went missing, and it was the only method configured.
• Conditional access switched on badly A rule such as "Portugal only" or "company devices only" went live with an error and locked everyone out, including its author.
• A departure with no handover An employee or the previous supplier left and took the credentials with them.
• Account taken over An attacker got in as administrator and changed the password and authentication methods.

The question is always the same: who gets in now without needing the account that went down?

A simple picture: think of the emergency hammer behind the glass on a train. Nobody uses it day to day, everyone knows where it is and breaking the glass sets off an alarm. When it is used, there has been an emergency, and it is recorded.

Microsoft documents the topic in Microsoft Entra, the identity service that underpins Microsoft 365. Translated into decisions:

• At least two If one becomes unusable or compromised, the other remains.
• Cloud-only, on .onmicrosoft.com Independent of the on-premises server, synchronisation and the custom domain.
• No personal owner No accounts named after an employee and no personal phones as a factor.
• Phishing-resistant, passwordless authentication A FIDO2 physical key (the option Microsoft favours) or a certificate, different from the method used by regular admin accounts.
• Outside the blocking rules Excluded from conditional access, so that a mistake does not lock them out too.
• Permanent global administrator The role always active, not "eligible" on activation request.
• Physically separated credentials Separate safes, accessible only to authorised people.
• An alarm on every use Any sign-in triggers a critical alert to the decision-makers.
• Quarterly test At most every 90 days and whenever the IT team or the subscription changes.

No. That practice ended when Microsoft made MFA mandatory on its admin portals, in the Microsoft 365 admin centre since February 2025. The documentation is explicit: emergency accounts are no exception.

For these accounts, Microsoft points to two methods: a FIDO2 physical key or certificate-based authentication. In an SME, the most practical route is two physical keys per account, in different locations. We compare the available methods in our guide to multi-factor authentication for businesses.

The company's management, never the IT supplier. It is a management decision, not a technical one.

• First key In the company safe, within reach of management.
• Second key Somewhere else: another office, a director's personal safe or a bank safe deposit box.
• Record Who has access, where they are and the date of the last test, in writing.
• Associated passwords In a business password manager, in a vault reserved for management.

The IT partner operates with named admin accounts, one per engineer. Break-glass accounts ensure the company is never dependent on anyone, us included. We recommend confirming this point in any contract, as we detail in what an IT contract should say about exit and data.

1. Are there two or more emergency accounts on .onmicrosoft.com?
2. Are they unlinked from any person or personal phone?
3. Do they authenticate with a physical key or certificate, rather than SMS or an app?
4. Are they excluded from the conditional access that blocks sign-ins?
5. Does management know where the keys are, and are they kept apart?
6. Does a sign-in to one of them trigger an alert immediately?
7. Was the last test less than 90 days ago?
8. Does each engineer have their own admin account, with no sharing?

Two or more "no" or "don't know" answers mean a concrete risk. Many of the failures we find in Microsoft 365 email protection start precisely in administration.

At the Union of Parishes of Massamá and Monte Abraão, DataRoad moved around 50 mailboxes to Exchange Online, with all content transferred, workstations and phones reconfigured and final validation. In a public body, administration of the environment must remain with the body, whoever the provider is.

It is the standard in every Microsoft 365 environment we manage: named accounts for engineers, emergency accounts in the client's hands and an unambiguous access record.

We audit admin and emergency accounts, authentication methods and access rules, and deliver the fixes in order of priority, with no commitment. See our Microsoft 365 management and the IT Unlimited managed services plans.

More than 10 workstations · support contract · remote, on-site and telephone support. +351 211 459 950 * · sales@dataroad.pt

*Call to a Portuguese landline.

• Microsoft Learn: emergency access accounts in Entra ID
• Microsoft Learn: mandatory MFA on admin portals