iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Prevent privileged lockout before an outage by maintaining at least two independently authenticated emergency administrator accounts, keeping their credentials under controlled but reachable custody, exempting them from policies that could block the recovery path, and rehearsing the complete process. In Microsoft Entra, Microsoft recommends two or more cloud-only emergency access accounts on the tenant’s .onmicrosoft.com domain, with permanently active Global Administrator roles and authentication that does not depend on federation, on-premises synchronization, or the same device and service used by ordinary administrators.
These accounts are often called break-glass accounts. They are not a replacement for normal least-privilege administration; they are a controlled way to recover the identity control plane when federation, MFA devices, networks, approval workflows, or administrator records fail.
Why privileged administrators get locked out
An outage can remove several independent ways to authenticate or obtain a role. Treat each dependency as a possible failure domain rather than assuming that a valid password guarantees access.
Recommended Free Tools
Identity-provider or federation failure
Federated administrator accounts may redirect authentication to an identity provider that is unavailable, misconfigured, or unreachable. If every privileged account depends on that federation, the cloud tenant can remain inaccessible even while the cloud service itself is operating.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
MFA device or service failure
Administrators can be unable to complete multifactor authentication when phones, authenticator services, certificate infrastructure, or the network carrying a challenge are unavailable. A policy that requires one specific factor creates a single point of failure.
Loss of the last administrator
An administrator who leaves may have an account disabled, removed, or recoverable only through an on-premises process that no longer works. Ownership tied to one person also makes an emergency response dependent on that person’s availability.
Network or regional disaster
A disaster can take mobile, private, or other communications networks offline. Emergency access therefore has to be evaluated against the networks, devices, and locations available during the incident, not only normal office conditions.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Role-approval dead end
If every Global Administrator or Privileged Role Administrator assignment is eligible through Privileged Identity Management and activation requires an approver, an outage can leave nobody able to approve the request. The recovery account must have a usable role without that approval chain.
Restrictive policy or configuration error
Conditional Access, compliant-device requirements, trusted-location rules, or a newly changed authentication policy can block all administrators. Microsoft describes identity as the control plane for applications and resources: a mistake in that control plane can prevent remediation elsewhere.
Build an independent emergency-access design
Create at least two emergency accounts
Microsoft’s current Entra guidance recommends at least two emergency access accounts. Two accounts provide redundancy if one credential, key, or account is unavailable, and they allow one account to be used while the other is investigated. Create them before an incident, not while ordinary administration is already impaired.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For Entra, make the accounts cloud-only and use the tenant’s .onmicrosoft.com domain. Do not federate or synchronize them from on-premises identity infrastructure. Assign each the Global Administrator role permanently rather than making the role merely eligible through Privileged Identity Management. Keep the accounts dedicated to emergencies instead of assigning them to named employees.
Cloud and on-premises recovery paths should be distinct. If a cloud emergency account obtains its authentication from another system that can fail in the same event, it is not an independent escape path. Organizations using another identity provider should apply that provider’s current recovery guidance rather than copying Entra-specific names or settings.
Document what qualifies as emergency use
Define an emergency as a condition in which ordinary privileged sign-in or role activation cannot be completed, such as an identity-provider outage, unavailable MFA service, widespread network failure, or a policy change that blocks administrators. Name the roles allowed to retrieve the credentials, the incident authority that can approve use when communications still work, and the person responsible for post-incident review.
Maintain an authorized-user list separately from the emergency accounts. The list should identify multiple trained responders, their contact methods, and a backup when a primary responder is unavailable. Remove departed personnel promptly and review the list whenever the administration team changes.
Choose authentication with different failure dependencies
The emergency method should be strong, supported by the identity provider, and independent of the ordinary administrator method. Microsoft’s current Entra recommendation is a FIDO2 passkey or certificate-based authentication where the organization already operates the required public key infrastructure. A physical security key can be used when FIDO2 is selected, but compatibility, registration, storage, and recovery must be verified for the particular tenant.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Method | What must remain available | Advantages | Failure questions to answer |
|---|---|---|---|
| FIDO2 passkey | A registered authenticator, a compatible sign-in client, and the identity provider’s FIDO2 support | Phishing-resistant authentication that can be independent of a phone-based MFA service | Are two registered authenticators available? Can an authorized responder retrieve one during a site or network outage? Is the key compatible with the tenant and emergency device? |
| Certificate-based authentication | A valid certificate, private-key protection, certificate authority or public key infrastructure, and a compatible client | Uses infrastructure already operated by organizations with mature certificate management | Can certificates be issued, renewed, validated, and accessed if the usual certificate services are down? Where is the private key stored, and who can retrieve it? |
| Other provider-supported method | The dependencies documented by that identity provider | May fit an existing recovery architecture | Does it rely on the same federation, device, network, policy, or communications channel that failed for normal administrators? |
Use a method different from the one normal administrators use when practical. For example, if ordinary administrators rely on a phone-based challenge, a FIDO2 key or certificate can remove that shared dependency. Do not add a second factor merely for variety if both factors depend on the same unavailable service.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
For broader workforce resilience, Microsoft describes using multiple valid authentication controls over different communication channels, such as an internet-based authenticator, an on-device OATH token, and SMS. Those are examples for general continuity, not a blanket recommendation for privileged emergency accounts. Select the strongest provider-supported method that responders can actually retrieve and test.
Prevent access policies from blocking the escape path
Review Conditional Access exclusions
In Entra, Microsoft advises excluding emergency accounts from Conditional Access policies that block or restrict sign-in. Review policies requiring multifactor authentication, a compliant device, a trusted location, a specific network, or another signal that may be unavailable during the incident. A report-only policy does not block access and does not need an exclusion, but it should still be reviewed so that a later enforcement change does not surprise responders.
An exclusion is a narrowly governed emergency control, not a general bypass. Restrict who can retrieve the credentials, alert on every sign-in, and record the reason and incident number. Keep the exclusion limited to the emergency accounts; do not broaden it to ordinary administrators or an entire group.
Prepare contingency policies
Create contingency Conditional Access policies in advance when the normal policy set could fail as a group. Document who can enable a contingency, which controls it changes, how the change is approved, and how the standard posture is restored. Microsoft’s resilient-control guidance says to weigh business continuity, operational and financial cost, and security risk when planning these alternatives.
Test the planned configuration in a controlled exercise. Confirm that the emergency account can sign in under the intended outage conditions, that ordinary accounts remain governed, and that responders know which policy to change without disabling unrelated protections.
Store credentials so they are controlled but reachable
Emergency credentials must be inaccessible to casual users but available to multiple authorized responders. Microsoft recommends keeping them known only to authorized people, avoiding employee-supplied phones, and using secure separate storage; fireproof safes in separate locations are one example. Select storage that remains reachable when the primary office, password-management service, or network is unavailable.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Keep each account’s secret, recovery material, and authentication device under a documented custody process.
- Use separate locations or custody holders so one building, person, or device failure does not remove every option.
- Record the retrieval procedure, identity checks, dual-control requirements, and return or replacement process after use.
- Do not place emergency secrets in a personal phone, an employee’s ordinary password vault, or a system that depends on the same identity provider being recovered.
- Limit written copies to what responders need, protect them from unauthorized viewing, and replace credentials when exposure is suspected.
The UK National Cyber Security Centre advises discussing cloud-provider account-recovery options before they are needed. Provider support channels, tenant ownership evidence, recovery contacts, and escalation details should be part of the continuity plan, not discovered during lockout.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsMonitor every use and rehearse the complete path
Alert immediately
Configure alerts for every emergency-account sign-in and relevant audit activity, with delivery to administrators other than the emergency account user. James L, a senior security researcher at the UK National Cyber Security Centre, wrote in its 21 June 2023 guidance: “When any emergency access is triggered (such as signing in to an emergency administrator account), it should send immediate alarms to your operations personnel so that they can investigate.”
Alerts should identify the account, time, source location or network information available, authentication method, and actions taken. Treat an unexpected sign-in as a possible compromise; do not assume that the account was used legitimately because it is reserved for emergencies.
Validate at least every 90 days
Microsoft specifies validating emergency accounts at least every 90 days. A useful test exercises the whole recovery chain:
- Choose an approved test window and notify monitoring personnel so the alert is not mistaken for an attack or ignored as routine.
- Have an authorized responder retrieve the credential and authentication device using the documented procedure.
- Sign in through the same tenant and client path that would be used during an outage, without weakening production policy for unrelated accounts.
- Complete one harmless administrative task, such as viewing configuration or creating a temporary test object, then reverse the change.
- Confirm that sign-in and audit alerts reach personnel who are not using the emergency account.
- Record the test date, responder, account, authentication method, observed alerts, task performed, and any corrective action.
- Return credentials and devices to secure storage, rotate them if the exercise exposed them, and update the written process.
Test after material changes to federation, Conditional Access, authentication registration, certificate infrastructure, network architecture, staffing, or provider configuration rather than waiting for the next 90-day interval.
Train responders without normalizing use
People who may need to act should know the retrieval, sign-in, notification, and restoration steps. The process should be deliberately inconvenient enough to discourage routine use: require a documented incident, controlled custody, and immediate review, while still allowing a responder to act when ordinary administration is unavailable.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Use this outage runbook
- Confirm the failure domain. Establish whether the problem is federation, MFA, network, Conditional Access, role approval, account lifecycle, or a broader provider outage. Avoid changing policies until the affected dependency is understood.
- Declare the incident and assign an incident lead. Record the time, affected administrators, services, and communications channel that remains available.
- Retrieve the least number of emergency credentials needed. Follow the custody procedure and use two-person authorization when your policy requires it.
- Verify the authentication path. Use the independent FIDO2, certificate, or provider-supported method and a device and network that do not depend on the failed component.
- Sign in and verify alerts. Stop if the expected alert does not arrive; an unmonitored emergency session is a control failure that needs investigation.
- Perform only the remediation required. Examples include correcting a blocking Conditional Access policy, restoring an administrator’s access, repairing federation, or enabling a documented contingency. Do not make unrelated changes from a Global Administrator session.
- Re-establish ordinary administration. Confirm that normal administrators can authenticate, activate roles, and complete MFA before ending the emergency session.
- End and secure the session. Sign out, return devices and credentials, rotate secrets if they were exposed, and disable any temporary contingency change.
- Review the audit trail. Compare sign-in, policy, role, and directory events with the incident record. Investigate unexpected activity and preserve evidence if compromise is possible.
- Improve the control. Update dependencies, contacts, policy exclusions, storage instructions, and training based on what failed.
Microsoft Entra implementation checklist
- Create at least two cloud-only accounts in the tenant’s
.onmicrosoft.comdomain. - Keep them out of federation and on-premises synchronization.
- Assign Global Administrator permanently active to each emergency account.
- Register FIDO2 passkeys or use certificate-based authentication where the organization’s public key infrastructure can support recovery.
- Use an authentication method with different failure dependencies from normal administrators.
- Exclude only the emergency accounts from blocking or restricting Conditional Access policies, and document the reason.
- Prepare and test contingency policies for predictable control-plane failures.
- Store credentials and authenticators separately from employee-owned devices and ordinary sign-in systems.
- Alert on every sign-in and relevant audit event; route alerts to other administrators.
- Validate the complete path at least every 90 days and after significant configuration changes.
These are Entra-specific settings and terminology. Other cloud identity providers may use different account types, role names, policy controls, and recovery requirements; consult their current documentation before implementing an equivalent design.
Common failure modes and fixes
| Failure | Why it defeats recovery | Preventive fix |
|---|---|---|
| Only one emergency account exists | A lost secret, damaged authenticator, or disabled account removes the sole escape path. | Maintain at least two independently retrievable accounts and test both. |
| Emergency account is federated or synchronized | The account fails with the same on-premises or federation outage as normal administrators. | Use a cloud-only account for cloud recovery, or the equivalent independent option documented by another provider. |
| Role is eligible only through approval | No approver may be able to activate the role during the outage. | For Entra emergency accounts, keep Global Administrator permanently active and monitor use. |
| Conditional Access blocks the account | MFA, compliant-device, location, or network requirements can be unavailable or misconfigured. | Review narrowly scoped exclusions and test a documented contingency policy. |
| Both factors use the same dependency | A second method does not help if both require the failed phone, network, provider, or certificate service. | Map dependencies and choose materially different authentication paths. |
| Credentials are on one employee’s phone | The phone, person, or mobile network may be unavailable, and personal custody is difficult to audit. | Use controlled, separate storage accessible to multiple authorized responders. |
| Alerts go to the emergency user only | Compromise or misuse can remain undetected, and the responder cannot independently verify monitoring. | Route immediate alerts to other operations personnel and test delivery. |
| Accounts are never exercised | A key may be unregistered, a certificate expired, a policy changed, or a procedure forgotten. | Run a documented end-to-end validation at least every 90 days. |
| Emergency access becomes routine | Frequent use increases exposure and bypasses normal controls. | Require an incident record, make retrieval controlled, alert immediately, and investigate every use. |
Balance recovery with security
Emergency accounts are highly privileged. A stolen credential can alter identity policy, create administrators, access applications, or conceal activity. Microsoft’s security guidance highlights insecure credentials, misuse, weak auditability, and untested accounts as risks. The design therefore has to combine reliable availability with strong independent authentication, restricted custody, immediate alarms, and regular exercises.
The NCSC notes that emergency access may not support every normal zero-trust signal. During a major outage, a responder may need an unmanaged device or fewer location and device assurances than usual. That reduction should be explicit, limited to the emergency account, monitored in real time, and removed from the environment as soon as ordinary controls are restored.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteNo published owner-attributed statistic establishes how often these controls prevent lockout. The figures that can be stated confidently are operational recommendations: Microsoft’s minimum of two emergency access accounts and validation at least every 90 days. Their value comes from reducing shared dependencies and proving that the process works before a real outage.
Governance after an incident
After any emergency-account use, reconcile sign-in and directory audit records with the incident timeline. Confirm the intended responder, authentication method, source information, role changes, policy changes, and objects touched. Investigate anything unexplained as a potential security incident.
Rotate credentials or replace authenticators when they were exposed, copied, or handled outside the documented custody process. Review whether the outage revealed a missing dependency, an overly broad policy exclusion, an unreachable storage location, or an alerting gap. Update the runbook, authorized-user list, training, and next test date before closing the incident.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
