Overview

Several Optimize365 controls harden authentication and access policies in your Microsoft 365 tenant. They're critical for security, but some can lock administrators out of the organization if emergency access (break glass) accounts aren't set up properly first. Set up and verify break glass accounts before you remediate any of the controls listed below.

What Are Break Glass Accounts?

Break glass (emergency access) accounts are cloud-only accounts with permanent Global Administrator privileges, meant for situations where normal admin accounts can't sign in — for example MFA outages, Conditional Access misconfigurations, federated identity provider failures, or the departure of a key administrator.

Microsoft recommends every tenant keep at least two of these accounts. Optimize365 checks this with control 1.1.2 ("Ensure two emergency access accounts have been defined").

Controls That Carry Lockout Risk

These controls change authentication or access policies and could stop every administrator from signing in if break glass accounts aren't in place, or aren't excluded from the affected policies:

Warning: Remediating any of these without working break glass accounts can cause a full tenant lockout. Recovery requires a Microsoft support case.

How Optimize365 Helps

When you open any control listed above, Optimize365 checks the result of control 1.1.2 and shows one of three statuses:

• Configured — 1.1.2 is passing. You can proceed, but always verify the accounts are excluded from the policies you're about to change.
• Not configured — 1.1.2 is failing. Fix this before remediating the control.
• Cannot validate — 1.1.2 wasn't included in the current scan. Verify your emergency access accounts manually before proceeding.

Set Up Break Glass Accounts

Account requirements

• Cloud-only — use the *.onmicrosoft.com domain. Don't sync these accounts from on-premises AD or use a federated domain.
• Permanent Global Administrator — assign the role directly, not through PIM eligible activation, so the accounts work even if PIM itself is unavailable.
• Non-obvious naming — avoid names like breakglass@ or emergency@. Use randomized, human-sounding names to reduce exposure to password spray attacks.
• Not tied to any individual — don't associate these accounts with a specific employee, personal phone, or personal device.

Authentication

Microsoft now enforces MFA on all admin portal sign-ins, so break glass accounts must be registered with a phishing-resistant method:

• FIDO2 security keys (recommended) — buy at least two keys per account and store them in separate, physically secure locations accessible to authorized personnel. See Microsoft's FIDO2 guidance.
• Certificate-based authentication — an alternative if FIDO2 keys aren't practical. See Configure CBA in Entra.

Don't rely on SMS or phone-call MFA for these accounts — those methods can fail during the same outages that trigger a break glass scenario.

Password policy

• Use a passphrase of at least 32 characters.
• Set the password to never expire.
• Split the password into parts and store each part separately (e.g., two halves in two different safes or vaults).
• Exclude the accounts from any automated inactive-user cleanup.

Conditional Access

Exclude at least one break glass account from all Conditional Access policies. That's the whole point of these accounts: they must bypass every policy that could block sign-in. Control 5.2.2.7 checks for this exclusion group.

For detailed steps, see Manage emergency access accounts - Microsoft Entra.

Further Reading

• Manage emergency access admin accounts - Microsoft Learn
• Plan your Conditional Access deployment - Microsoft Learn
• Plan for mandatory MFA in Entra - Microsoft Learn
• Secure access practices for administrators - Microsoft Learn

Related Articles

• Remediation
• Conditional Access Policies
• Manually Enabling Remediation Roles for Optimize365