How to Configure Break-Glass Emergency Access Accounts in Microsoft Entra ID

Create two break-glass accounts:

Connect-MgGraph -Scopes "User.ReadWrite.All","RoleManagement.ReadWrite.Directory","Directory.ReadWrite.All"

# Generate strong passwords: 50+ character random strings
$password1 = [System.Web.Security.Membership]::GeneratePassword(64, 16)
$password2 = [System.Web.Security.Membership]::GeneratePassword(64, 16)

# Create account 1
$bg1 = New-MgUser -BodyParameter @{
  DisplayName = "Break Glass 01"
  UserPrincipalName = "breakglass01@yourtenant.onmicrosoft.com"  # Must use .onmicrosoft.com
  AccountEnabled = $true
  PasswordProfile = @{
    Password = $password1
    ForceChangePasswordNextSignIn = $false
  }
  PasswordPolicies = "DisablePasswordExpiration,DisableStrongPassword"
  UsageLocation = "US"  # Required for license assignment if needed
}

# Create account 2
$bg2 = New-MgUser -BodyParameter @{
  DisplayName = "Break Glass 02"
  UserPrincipalName = "breakglass02@yourtenant.onmicrosoft.com"
  AccountEnabled = $true
  PasswordProfile = @{
    Password = $password2
    ForceChangePasswordNextSignIn = $false
  }
  PasswordPolicies = "DisablePasswordExpiration,DisableStrongPassword"
}

# Assign Global Administrator role to both
$gaRole = Get-MgDirectoryRole -Filter "DisplayName eq 'Global Administrator'"
New-MgDirectoryRoleMemberByRef -DirectoryRoleId $gaRole.Id \
  -OdataId "https://graph.microsoft.com/v1.0/users/$($bg1.Id)"
New-MgDirectoryRoleMemberByRef -DirectoryRoleId $gaRole.Id \
  -OdataId "https://graph.microsoft.com/v1.0/users/$($bg2.Id)"

# Record the account IDs for use in Conditional Access exclusions
Write-Host "Break Glass 01 ID: $($bg1.Id)"
Write-Host "Break Glass 02 ID: $($bg2.Id)"

What NOT to do:

• Do not assign licenses unless required: unlicensed accounts have fewer features to compromise
• Do not register MFA methods: defeat the purpose
• Do not add to any federated domain
• Do not add to regular admin groups that might be included in sync to on-premises AD
• Do not store credentials in the same password manager as normal admin accounts

Break-glass credentials must be accessible when all digital systems are potentially compromised or inaccessible.

Physical storage options (in priority order):

1. Two separate physical safes in two locations: Password 1 in the IT manager's office safe, Password 2 in the CFO's office safe (or any two physically separate locations). Each envelope contains one password: access to both locations is required to compromise both accounts.

2. Sealed physical envelopes with tamper-evident tape: Store in the safe. Date and initial the seal annually during testing. Any broken seal indicates unauthorized access.

3. Hardware key escrow: Some organizations use a hardware security module (HSM) or Thales key ceremony approach where multiple key holders must be present to reconstruct the credential.

What NOT to do:

• Store in LastPass, 1Password, or any cloud-based password manager (may be unavailable or compromised during the incident requiring break-glass access)
• Store in a digital file on a corporate system (may be encrypted by ransomware or inaccessible during an identity incident)
• Store both passwords with the same person

Annual rotation and testing:

# Rotate break-glass passwords annually
$newPassword = [System.Web.Security.Membership]::GeneratePassword(64, 16)
Update-MgUser -UserId "breakglass01@yourtenant.onmicrosoft.com" -PasswordProfile @{
  Password = $newPassword
  ForceChangePasswordNextSignIn = $false
}

# After rotation:
# 1. Update the physical envelopes
# 2. Shred the old credential documentation
# 3. Document the rotation in your change management system

Exclude from all Conditional Access policies:

# Create a group for break-glass exclusions
$bgGroup = New-MgGroup -DisplayName "CA-Exclusion-Emergency-Access" \
  -MailEnabled:$false \
  -SecurityEnabled:$true \
  -MailNickname "CA-Exclusion-Emergency-Access"

# Add break-glass accounts to the group
New-MgGroupMember -GroupId $bgGroup.Id -OdataId "https://graph.microsoft.com/v1.0/users/$($bg1.Id)"
New-MgGroupMember -GroupId $bgGroup.Id -OdataId "https://graph.microsoft.com/v1.0/users/$($bg2.Id)"

# When creating any Conditional Access policy, add this group to Exclude:
# Users > Exclude > Groups: CA-Exclusion-Emergency-Access

Alert on any break-glass sign-in: this is critical:

Any authentication using a break-glass account is either an emergency or a breach. It must generate an immediate alert.

# Microsoft Sentinel: alert on break-glass sign-in
SigninLogs
| where UserPrincipalName in ("breakglass01@yourtenant.onmicrosoft.com", 
                               "breakglass02@yourtenant.onmicrosoft.com")
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, 
          Location, ResultType, ConditionalAccessStatus

# Create alert rule: fire immediately on any row matching this query
# Notification: page the security team, not just email (email may be unavailable during the incident)

Microsoft Entra ID built-in alerts:

Entra ID > Monitoring > Diagnostic Settings > Sign-in Logs
Send to: Log Analytics workspace (for Sentinel alerts)
OR
Entra ID > Protection > Identity Protection > Alerts
Configure alerts for specific user accounts

Annual test procedure:

Test break-glass accounts once per year to verify they work as expected:

1. Retrieve credentials from physical storage
2. Sign in to a non-production Azure portal session
3. Verify Global Admin access is granted
4. Verify Conditional Access did not block the sign-in
5. Verify the sign-in alert fired and reached the security team
6. Rotate credentials after testing (treat the test as credential exposure)
7. Reseal and store new credentials

Document the test results in your security audit log.