Skip to content
Andy Kemp Tools

Privileged Access

Break-glass Account Builder

A complete, recommended design for Microsoft Entra ID emergency access accounts: the accounts, how they sign in, where the keys are kept, Conditional Access, alerting, a quarterly test plan and a runbook.

Based on Microsoft's emergency access guidance and mapped to CIS Microsoft 365, the NCSC Cyber Assessment Framework, NIST SP 800-53, the ASD ISM and ISO 27001. Everything runs in your browser; nothing you enter is sent anywhere.

Your tenant

Used to name the accounts and fill in the alert queries and verification script.

.onmicrosoft.com

Accounts and sign-in

Microsoft recommends at least two accounts, each signing in with passkey (FIDO2) security keys.

Conditional Access

Emergency accounts are always excluded from your Conditional Access policies. You can optionally add policies that apply only to them.

Any Conditional Access applied to emergency accounts is at your own risk: it could block you in the emergency they exist for.

Monitoring and alerting

Recommended: send sign-in logs to Log Analytics, alert on every emergency sign-in with KQL, and send alerts to people who are on call 24/7.

Recommended without asking

  • Two keys or cards per account, in fireproof safes at two sites
  • Excluded from every Conditional Access policy through a protected group
  • Sign in from the cleanest device available, never one that depends on Entra ID
  • Tested every quarter, and after any use or major change