Every organization using Microsoft 365 must ensure it can recover administrative access under any circumstance. This is where break-glass accounts come in — specialized emergency access accounts that act as a last resort if all other admin paths are blocked. Determining the right number of break-glass accounts is critical not only for security but also for operational resilience. At Interlock IT, we've helped countless Canadian businesses avoid costly lockout situations and ensure compliance with Microsoft's most current security guidance.
Microsoft 365 Break-Glass Accounts: A Concise Definition
Break-glass accounts (sometimes called emergency access accounts or firecall admins) are dedicated administrator accounts designed for extreme situations when standard admin access is unavailable. Typical triggers include:
Locked-out administrators due to Conditional Access, accidental policy misconfiguration, or multi-factor authentication (MFA) outages
Issues with hybrid identity or federation making usual admin sign-in impossible
Critical incidents requiring immediate administrative intervention
Break-glass accounts are always kept cloud-only (not dependent on on-premises Active Directory or federation) and are excluded from Conditional Access policies that could block entry during an emergency.
How Many Break-Glass Accounts Does Your Business Need?
The clear consensus from Microsoft and security experts is that every business should maintain at least two break-glass accounts for Microsoft 365. For most small and medium-sized businesses (SMBs), two cloud-only, Global Administrator accounts provide the best balance of redundancy, simplicity, and risk mitigation.
Minimum recommended: 2 break-glass accounts
Upper practical limit: Keep the overall Global Administrator population under 5, including break-glass accounts
Scenarios for additional accounts: Only when your business has specific operational, regulatory, or split-custody requirements
A single break-glass account leaves you vulnerable to accidental lockout if credentials are lost, compromised, or misconfigured. Two accounts ensure you always have a backup path to recover administrative access, as recommended by Microsoft’s best practices.
Why Two (Not One)? The Principle of Redundancy
With only one break-glass account, your entire fallback strategy rests on a single point of failure. If that account is affected by a misconfiguration, lost credentials, or a blocking Conditional Access rule, you're out of options. Having two independent accounts, each stored and managed separately, ensures resilience to a wide range of risk events — from technical issues to human error.
When Would You Need More Than Two?
Our experience at Interlock IT shows that very few organizations need more than two, except where there are clear operational reasons such as dual admin teams in different regions or split-duty for compliance. Always keep the total admin count minimal — more admin accounts increase attack surface without adding meaningful assurance in most SMB setups.
Break-Glass Account Setup: Step-By-Step Framework
Create two cloud-only accounts using your tenant’s default domain (eg, user@yourcompany.onmicrosoft.com). This ensures no dependency on on-premises identity.
Assign the Global Administrator role directly and permanently to each account.
Set long, random passwords and store securely in two separate protected locations offline (like a physical safe and a secure password manager).
Exclude at least one account from all Conditional Access and sign-in risk policies that could block login during an emergency. Configure varied authentication methods to prevent a single failure disabling both accounts.
Do not assign Microsoft 365 licenses unless a business requirement justifies it. These accounts only need to access the admin portal, not user services.
Enable alerting on all use, so any login attempt generates a notification to IT or security leaders for investigation.
Test login monthly from a clean system to verify credentials and access pathways are fully operational. Change passwords and update documentation if used.
What Can Go Wrong: Common Break-Glass Account Mistakes
Maintaining only one break-glass account, exposing the business to total lockout risk
Making break-glass accounts dependent on on-premises AD or federation, which could fail at the same time as regular admin paths
Allowing break-glass accounts to be blocked by Conditional Access or risky sign-in policies
Reusing authentication methods for both break-glass accounts (eg, same authenticator app, same physical location for credentials)
Neglecting monthly testing and failing to rotate passwords after use
Letting Global Administrator numbers creep higher than needed, increasing risk exposure
Best Practices for Managing Microsoft 365 Break-Glass Accounts
Keep break-glass account credentials strictly offline, available only to those with defined emergency responsibilities
Ensure separate physical or digital custody for each account (eg, one held by IT, the other by senior leadership or a trusted third party)
Configure alerting for every use so there’s an audit trail and potential security incidents are quickly detected
Document the emergency use process and make sure at least two people know the recovery procedure
Test access monthly, not just after policy changes or IT team changes
After any use, change passwords immediately and review sign-in logs for anomalies
We work closely with companies to fit these best practices into broader Microsoft 365 and cloud security programs.
Break-Glass Accounts in the Wider Security Picture
Break-glass accounts are only one piece of a modern Microsoft 365 security posture. They need to be integrated with:
Ongoing admin account lifecycle management
Backup and recovery planning
Robust audit processes and regular policy reviews
At Interlock IT, we emphasize that break-glass accounts complement, not replace, good cloud governance and multi-layer security measures.
Who Should Hold Break-Glass Credentials?
It's essential that personnel holding break-glass credentials are:
Trusted and aware of the sensitivity and purpose of these accounts
Trained in the documented recovery process
Available on short notice (to respond quickly to emergencies)
Not solely responsible — dual custody practices are encouraged
For Canadian organizations, this often means a combination of IT leads and C-suite, or an IT leadership team with oversight by another senior manager. Interlock IT frequently guides SMBs through these governance conversations as part of a larger IT strategy review.
How Interlock IT Supports Break-Glass Planning
Our team at Interlock IT conducts in-depth Microsoft 365 security reviews for small and medium-sized businesses, focusing on practical emergency recovery strategies. Our support includes:
Assessing your current admin and break-glass account configuration
Aligning Conditional Access and security defaults to prevent accidental lockouts
Establishing a simple documentation and testing calendar
Providing role-based guidance on account custodianship, MFA choices, and compliance considerations
Tightening Global Administrator controls and cleaning up unused privileged accounts
If you’re performing a DMARC audit or reviewing license allocations, it is an ideal time to reassess your emergency access strategy as part of a full security hygiene refresh.
FAQ: Microsoft 365 Break-Glass Accounts
What exactly is a break-glass account in Microsoft 365?
A break-glass account is a cloud-only, highly privileged account designed for emergency use when standard administrator sign-in is blocked. Its purpose is to provide a guaranteed backdoor to recover administrative control of your Microsoft 365 environment.
How many break-glass accounts should I have for a small business?
The recommended minimum is two cloud-only break-glass accounts. This ensures redundancy in case one set of credentials is lost or inaccessible.
Should break-glass accounts be excluded from Conditional Access policies?
Yes. At least one break-glass account must be excluded from Conditional Access and similar policies to guarantee sign-in even if organizational rules fail or block admins unexpectedly.
Do break-glass accounts require a paid Microsoft 365 license?
No, break-glass accounts do not require licenses unless they need access to services beyond the admin portal. Many organizations keep them unlicensed intentionally to reduce risk and complexity.
How often should I test break-glass account access?
Monthly testing is the best practice. This regular cadence helps ensure credentials are available and policies have not inadvertently blocked access.
Can a break-glass account use multi-factor authentication?
Preferably, configure varied authentication methods across your break-glass accounts, but keep at least one account accessible in the broadest range of scenarios. Customize based on your Conditional Access and threat model.
What documentation or process should I put in place?
Businesses should maintain a brief playbook documenting who holds break-glass credentials, where they are stored, and how to access them safely. Assign at least two people responsible for periodic testing and incident response.
Conclusion
Getting break-glass account strategy right is a non-negotiable for robust Microsoft 365 security. For most Canadian businesses, two carefully managed, cloud-only admin accounts offer the ideal balance of resilience and simplicity. Oversight, separation of credentials, and monthly testing form the foundation of a reliable emergency access plan.
Leverage the expertise of Interlock IT to review or implement your Microsoft 365 break-glass accounts as part of a comprehensive cloud security, licensing, or DMARC audit. Secure your access, protect your investment, and ensure you are following true industry best practices every step of the way.
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.