Recovering from an identity-provider outage requires a prebuilt, independently usable authentication path. During the incident, first identify whether the failure is the IdP itself, federation, a downstream access service, MFA delivery, or a local configuration. Then use only a tested break-glass design that does not depend on the failed component, record every action, and remove temporary access after normal sign-in is restored.
Why an identity-provider outage can lock out administrators
Most enterprise sign-ins are a chain: a user and device reach an identity provider (IdP), the IdP performs authentication and MFA, federation passes an assertion to an application or cloud access service, and a privileged role is evaluated. A failure at any link can look like “the identity provider is down,” but the correct recovery route depends on the broken link.
As an Amazon Associate I earn from qualifying purchases.
- IdP outage: the provider cannot authenticate users or serve its administration plane.
- Federation outage: an on-premises federation service, such as AD FS, cannot issue or validate sign-in requests.
- Downstream access-service outage: a service such as IAM Identity Center is unavailable while the external IdP still works.
- MFA or device failure: passwords and federation work, but the required factor, phone, network, or device does not.
- Configuration or policy error: Conditional Access, trust, role, or application settings reject otherwise valid users.
A fallback designed for one case may fail in another. For example, AWS IAM Identity Center’s documented emergency route still requires the external IdP; it is not an answer to an outage of that IdP. An Okta regional recovery feature addresses eligible infrastructure failures, not every configuration or third-party problem. Map the dependency chain before selecting a recovery action.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsBuild the recovery path before an outage
Responders may be unable to create an emergency account, role, trust, or application after administrative access is lost. AWS explicitly recommends deploying its emergency configuration before a disruption because the required IAM roles cannot be created if access to create them is also disrupted. Treat the following as an operational control, not an optional convenience.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Document the dependency map
For each critical tenant and application, record the normal sign-in route and an independent route. Include the user or device, network path, IdP, federation service, MFA provider, cloud access broker, privileged role, and the emergency authenticator. Note which components are in the same region, account, directory, or network segment; shared dependencies defeat apparent redundancy.
Create narrowly scoped emergency identities
Use separate emergency identities rather than personal administrator accounts. Microsoft’s Entra guidance recommends at least two cloud-only emergency access accounts so that one factor or operator failure does not eliminate the only route. These accounts are independent of federated providers, permanently assigned the necessary active Global Administrator role, and reserved for emergencies. Microsoft’s own wording is explicit: “Use emergency access accounts only for emergency or ‘break glass’ scenarios where normal administrative accounts can’t be used.”
Do not copy Entra-specific settings blindly to another platform. On every system, define the minimum roles, approved operators, escalation authority, and the exact events that permit use. Keep emergency accounts outside routine administration and ordinary automation.
Use authentication that survives the suspected failure
Microsoft identifies phishing-resistant methods such as FIDO2 security keys or certificate-based authentication for emergency Entra accounts. A hardware key can help when federation, a phone network, or a normal device is unavailable, but purchasing a key is not a recovery plan by itself. Confirm that the IdP supports the protocol, enroll more than one approved factor where policy permits, store the factors so authorized responders can reach them, and test the complete sign-in flow.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Keep recovery factors separate from the primary administrator’s everyday devices. A key locked in an inaccessible office, a certificate whose issuing service is down, or an authenticator requiring the failed IdP provides no practical resilience.
Prevent policy lockout while preserving security
Review Conditional Access, MFA, device-compliance, network-location, session, and risk policies against the emergency identities. Microsoft warns that a policy blocking emergency accounts can make them unusable; its model is to exclude those accounts deliberately from policies that would prevent access, while monitoring them aggressively. Do not disable controls ad hoc during an incident. Record each exception, its owner, expiration or removal condition, and the compensating alert.
Protect credentials and monitor every use
- Store passwords, recovery codes, certificates, and key custody instructions in an access-controlled vault with an offline or independently reachable procedure.
- Separate approval from retrieval where your policy requires two-person control.
- Send high-priority alerts for emergency-account sign-ins, factor changes, password resets, role changes, policy exclusions, and direct-federation activation.
- Preserve sign-in, audit, federation, and cloud-control-plane logs in a location that does not rely on the failed service.
- Record who authorized use, which account was used, the role assumed, start and end times, and every configuration change.
Test on a schedule
Test the whole path, not merely whether an account exists. Microsoft’s Entra checklist calls for validating emergency-account functionality at least every 90 days. Exercise each factor, network route, role, alert, log pipeline, and vault procedure. Test the precise failure you are planning for: federated sign-in unavailable, MFA delivery unavailable, a cloud access service unavailable, or a regional provider failure. A test that relies on the same IdP being tested does not demonstrate independence.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Incident runbook: what to do when sign-in fails
- Declare and scope the incident. Identify affected users, tenants, applications, regions, and administrator functions. Check the IdP’s official service-status source and your own telemetry. Okta documents cell-level service status; if the status page is unreachable or shows no incident, continue troubleshooting instead of assuming the provider is healthy.
- Classify the failed component. Test a known-good user, a known-good application, and an administrative endpoint through an alternate network where permitted. Determine whether the fault is authentication, MFA, federation, a downstream service, or local configuration. Capture timestamps and error identifiers.
- Select a preconfigured route that matches the failure. Verify every remaining dependency before enabling it. An emergency path that still calls the failed IdP, region, network, or factor is not suitable for this incident.
- Authorize and authenticate responders. Follow the approved emergency process, use the least necessary role, and use an independently available phishing-resistant factor when configured. Avoid improvising by turning off broad security policies.
- Record and monitor use. Open an incident record before making changes when possible. Enable or verify alerts, retain relevant logs, and note every user, role, trust, policy, and application change. Microsoft advises inspecting sign-in reports while accounting for reporting delay and saving logs for investigation.
- Operate with temporary access. Limit actions to restoration, containment, and essential administration. Do not use a break-glass identity for unrelated work, create permanent accounts during the emergency, or distribute its credentials through ordinary chat.
- Return to normal access deliberately. Confirm the provider and dependent services are healthy, communicate the transition, end emergency sessions, remove temporary memberships, disable temporary federation, restore planned policy, and review the audit trail.
Microsoft Entra: federated sign-in unavailable
Entra cloud-only emergency access accounts are intended to avoid dependence on a federated identity provider. Microsoft recommends at least two such accounts, phishing-resistant authentication such as FIDO2 security keys or certificate-based authentication, permanent active Global Administrator assignment, secure credential storage, purposeful exclusion from blocking Conditional Access policies, and high-priority monitoring of sign-ins and audit activity. These are Entra-specific recommendations; their roles, policy controls, and factor behavior must be validated in your tenant.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use the emergency accounts
When normal administrators cannot authenticate through federation, notify the responsible managers and security officers, consult the incident playbook, retrieve the approved emergency credentials and factor, and sign in through the Entra administrative endpoint. Check sign-in and audit reports, remembering that reporting can lag the event. Open a Microsoft support request where appropriate and preserve evidence before changing configuration.
Hybrid AD FS failure: conditional managed-authentication switch
For a hybrid environment in which on-premises federation and AD FS are unavailable, Microsoft describes temporarily switching from federated authentication to managed authentication using password hash synchronization. This is conditional on that architecture and on password hash synchronization already being available; it is not a universal outage toggle. Reverse the change when AD FS is restored, verify that federation claims and policies behave normally, and retain the change record.
AWS IAM Identity Center: service unavailable while the external IdP works
AWS documents a different failure domain. The emergency design uses direct federation from the external IdP into AWS, an emergency group, and pre-created roles and trust relationships in workload accounts. During normal operations the emergency group can have no members. During an IAM Identity Center disruption, an IdP administrator adds designated trusted users, who authenticate to the still-available IdP and assume the emergency roles.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Fail over
- Confirm that IAM Identity Center is the failed component and that the external IdP and AWS IAM data plane remain available.
- Have the authorized IdP administrator enable the preconfigured direct-federation application.
- Process access requests through the existing approval mechanism; do not add unapproved users merely because the service is degraded.
- Add the approved users to the emergency groups and have them authenticate through the external IdP.
- Confirm that each user receives only the intended workload-account role and that activity is logged and alerted.
This design does not independently recover access when the external IdP itself is down. Its value is that it bypasses IAM Identity Center while preserving the external IdP as the authentication authority.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Fail back
When AWS confirms that IAM Identity Center is healthy, tell emergency users to sign out and return through the usual access portal. Disable the direct-federation application, remove emergency group members, verify that ordinary assignments work, and review role and federation logs. AWS’s documented cleanup sequence is important: leaving the direct route or temporary membership enabled extends the exposure beyond the incident.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Okta: regional disaster recovery and local credentials
Okta describes Standard Disaster Recovery across regions and availability zones for eligible infrastructure events. Okta says failover usually takes one hour after it identifies a primary-region infrastructure outage. During failover, administrators have read-only Admin Console access, users may continue accessing applications, and users cannot reset passwords. These are Okta-published targets and scope statements, not independent measurements or guarantees for every failure.
Okta says Enhanced Disaster Recovery has a five-minute recovery time objective for supported products. Coverage is product-specific; the documented exclusions include Okta Workflows, Okta Identity Governance, and Auth0 Customer Identity Cloud. Check the current entitlement and product coverage for the affected organization before relying on the feature.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Use the Disaster Recovery Admin app correctly
The Okta Disaster Recovery Admin app requires locally sourced Okta credentials and a supported factor. It does not support authentication through an external IdP, so an external-IdP outage cannot be solved by attempting that route with federated credentials. Bookmark the app for eligible organizations, keep local credentials and factors accessible to authorized responders, and verify the target and failover state before making changes.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Okta’s mechanism addresses infrastructure, storage, or networking problems affecting core Okta products. It does not cover denial-of-service attacks, third-party vendor or application-connection failures, malicious data changes, or configuration errors. For self-service failover, the organization must initiate failback after mitigation. Treat failback as an explicit operation rather than assuming the service will return to the original state automatically.
Compare the documented recovery approaches
| Approach | Failure addressed | Dependency that remains | Operational requirements |
|---|---|---|---|
| Entra cloud-only emergency administrator accounts | Federated sign-in unavailable, MFA or device problems, or Entra administrator lockout | Entra and the configured emergency authentication path | At least two accounts, independent factors, secure storage, intentional Conditional Access scope, alerts, and a sign-in test at least every 90 days |
| AWS IAM Identity Center direct federation | IAM Identity Center disruption | External IdP and AWS IAM data plane | Prebuilt roles and trust relationships, authorized IdP administrator, approved emergency groups, direct-federation activation, and cleanup after recovery |
| Okta Disaster Recovery Admin app | Eligible regional infrastructure outage affecting supported Okta organizations | Locally sourced Okta credentials, supported factor, eligible product coverage, and an included outage type | Read-only Admin Console limitations during failover, no password resets, current entitlement check, bookmarked app, and an explicit failback action |
Common mistakes and how to correct them
Assuming every fallback is independent
Trace each emergency route to its authentication, network, region, and control-plane dependencies. If the route still invokes the failed IdP, it cannot solve an IdP outage. Replace it with a cloud-only account, locally authenticated provider account, or another path that has been tested for that exact failure.
Creating the break-glass setup during the outage
Creation usually requires the same administrative plane that is unavailable. Build roles, trusts, emergency groups, accounts, factors, alerts, and vault procedures in advance, then test them without weakening ordinary controls.
Using a factor that is technically separate but operationally unreachable
A security key or certificate is useful only if it is supported by the tenant, enrolled to the emergency identity, stored securely, and available to an authorized responder. Keep custody instructions and an alternate approved factor under the same controlled process.
Leaving temporary access enabled
Emergency memberships, direct-federation applications, policy exclusions, and elevated sessions should have named owners and removal conditions. After service health is confirmed, end sessions, remove memberships, disable temporary applications, restore policies, and verify that normal access is working.
Treating vendor recovery targets as guarantees
Okta’s one-hour Standard Disaster Recovery statement and five-minute Enhanced Disaster Recovery objective apply only to the documented products and outage conditions. They do not promise recovery for configuration errors, third-party failures, or excluded products. Plan internal continuity around the capability you have actually tested.
Post-incident validation
- Confirm the original IdP, federation service, MFA delivery, and downstream access service are healthy.
- Verify ordinary users and administrators can sign in through the normal portal.
- End emergency sessions and rotate or invalidate credentials if the incident exposed them.
- Remove temporary group membership, direct-federation activation, policy exclusions, and elevated roles.
- Preserve sign-in, audit, federation, cloud, and incident logs with synchronized timestamps.
- Compare what happened with the dependency map and update the runbook, ownership, contact details, and factor-custody instructions.
- Schedule a controlled retest, including the failure mode that caused the incident and the alert that should have detected emergency use.
The durable answer to “What should we do if our identity provider is unavailable?” is not a single emergency account or a particular vendor feature. It is a documented, independently authenticated, least-privilege route matched to the failed component, exercised on a schedule, monitored whenever used, and removed cleanly when normal access returns.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
