How to create a break-glass account in Entra ID
8slides. Screenshot a slide, download it as a PNG, or use your browser's Print → Save as PDF for a LinkedIn-ready multi-page carousel — each slide becomes one page.
How to create a break-glass account in Entra ID
How to create an emergency access (break-glass) account in Entra ID: cloud-only, permanent Global Admin, excluded from Conditional Access, FIDO2 keys, alerting.
Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-create-a-break-glass-account-in-entra-id
How many break-glass accounts should a tenant have?
Two. One is a single point of failure — if its key is in a safe in an office you cannot reach, you are locked out. Two accounts, with credentials stored in different physical locations and held by different people, is M…
Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-create-a-break-glass-account-in-entra-id
Should break-glass accounts have MFA?
Yes, but not phone-based MFA. Microsoft's current guidance is phishing-resistant methods — FIDO2 security keys or certificate-based authentication — registered on keys stored with the credentials. Exclude the accounts f…
Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-create-a-break-glass-account-in-entra-id
Should the break-glass account be eligible in PIM or a permanent Global Administrator?
Permanent active assignment. The point of the account is to work when PIM, Conditional Access, MFA, or federation is broken; an eligible assignment that needs activation through PIM defeats the purpose. Accept the stand…
Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-create-a-break-glass-account-in-entra-id
Step 1: Create the accounts
Entra admin center → Users → New user. Use the tenant's .onmicrosoft.com domain, not a federated or synced domain — a federation outage must not affect the account. Pick a name that does not announce itself in a directo…
Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-create-a-break-glass-account-in-entra-id
Step 2: Assign Global Administrator permanently
Entra → Roles and administrators → Global Administrator → Add assignments. If PIM is in use, choose Active assignment type with Permanently assigned — not Eligible. Put a justification in the ticket, not just the PIM pr…
Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-create-a-break-glass-account-in-entra-id
Step 3: Register FIDO2 keys
Sign in as the break-glass account (from a clean admin workstation) to My Security Info and add both security keys. Set a PIN on each key; record the PIN with the password. Register no phone number, no Authenticator, no…
Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-create-a-break-glass-account-in-entra-id
Step 4: Create the exclusion group and exclude it everywhere
Create a security group CA-Exclude-BreakGlass with both accounts as members, assignable-to-role protected if you like. Add it to Exclude on every existing Conditional Access policy, including report-only ones, and make…
Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-create-a-break-glass-account-in-entra-id
Auto-generated from How to create a break-glass account in Entra ID. This page is not indexed and isn't part of the guide itself.