Privileged Access

Break-glass Account Builder

A complete, recommended design for Microsoft Entra ID emergency access accounts: the accounts, how they sign in, where the keys are kept, Conditional Access, alerting, a quarterly test plan and a runbook.

Based on Microsoft's emergency access guidance and mapped to CIS Microsoft 365, the NCSC Cyber Assessment Framework, NIST SP 800-53, the ASD ISM and ISO 27001. Everything runs in your browser; nothing you enter is sent anywhere.

Your tenant

Used to name the accounts and fill in the alert queries and verification script.

Organisation name (optional)

Tenant name

.onmicrosoft.com

Licensing

How users sign in

Prepared by (optional)

Accounts and sign-in

Microsoft recommends at least two accounts, each signing in with passkey (FIDO2) security keys.

Number of accounts

Emergency sign-in method

What your normal admins sign in with

Account names

Conditional Access

Emergency accounts are always excluded from your Conditional Access policies. You can optionally add policies that apply only to them.

Policies for the emergency accounts

Any Conditional Access applied to emergency accounts is at your own risk: it could block you in the emergency they exist for.

Monitoring and alerting

Recommended: send sign-in logs to Log Analytics, alert on every emergency sign-in with KQL, and send alerts to people who are on call 24/7.

Where logs go

Who gets the alerts

Recommended without asking

Two keys or cards per account, in fireproof safes at two sites
Excluded from every Conditional Access policy through a protected group
Sign in from the cleanest device available, never one that depends on Entra ID
Tested every quarter, and after any use or major change

Questions

Where does what I enter go?

Nowhere. The design is worked out in your browser and nothing you enter is sent anywhere.

Do I need an account?

No account is needed to design. Downloading the Word design, scripts, queries and test plan needs a free andykemp.com account.

Related tools