The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →A break-glass account—also called an emergency access account—is a highly privileged account reserved for restoring access when normal administrator accounts or their authentication paths fail. It is not for routine administration. Secure it so authorized responders can use it during a real outage, while every sign-in is tightly controlled, detected, and reviewed.
What a break-glass account is for
Microsoft describes emergency access accounts as accounts to use only in emergency or “break glass” scenarios where normal administrative accounts cannot be used. The purpose is recovery: for example, if administrators are locked out or their usual sign-in method, device, or identity-provider path is unavailable.
As an Amazon Associate I earn from qualifying purchases.
Because the account can have broad privileges, it creates a deliberate trade-off: it must remain usable when ordinary controls fail, but it must be difficult to misuse. Treat it as a controlled recovery mechanism, not as a backup account for everyday work.
How to design emergency access accounts
Build in redundancy and independence
For Microsoft Entra ID, Microsoft recommends maintaining at least two emergency access accounts. Separate accounts reduce the chance that one lost credential or unusable authentication method leaves the organization without a recovery path. Do not tie them to a particular employee.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Microsoft’s Entra guidance recommends cloud-only accounts that do not depend on a federated identity provider. That distinction matters if the federation service itself is unavailable. Organizations using another identity platform or a hybrid design should follow that platform’s own recovery guidance rather than copy Entra-specific settings.
Keep exceptional privileges separate from daily work
Microsoft recommends permanent active Global Administrator assignments for Entra emergency accounts. This is a Microsoft-platform-specific recommendation for accounts intended to preserve access in a lockout scenario; it also makes them exceptionally sensitive. Restrict who can retrieve and use them, and keep routine administrator accounts separate.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
For everyday administration, minimize broad privileges and grant only what each task requires. CISA recommends least privilege for administrative functions and advises considering separation of duties. In its 2025 TIC 3.0 Cloud Use Case v1.2, CISA also discusses emergency-only global administrator accounts in federal cloud contexts; those recommendations do not establish one universal configuration for every organization.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →How to protect sign-in without locking responders out
Use phishing-resistant authentication
Microsoft recommends phishing-resistant methods for Entra emergency accounts, including FIDO2 security keys and certificate-based authentication. It also advises using an authentication method different from the one used by ordinary administrators. The workable choice depends on the identity platform, supported authenticators, and how enrollment and recovery are configured. A security key is one part of the design, not a complete emergency-access plan.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Review Conditional Access for recovery failures
A Conditional Access policy can undermine the account’s purpose if it requires something unavailable during an incident—for example, a compliant device or an authentication path affected by the outage. Microsoft’s Entra guidance recommends excluding emergency accounts from policies that would block or restrict their sign-in, while retaining strong protection such as phishing-resistant authentication.
This is not a blanket instruction to turn off MFA or remove safeguards. Review the actual policies and dependencies, then test the exact account configuration. Microsoft 365 admin security guidance also recommends a 16-character password for the scenario in which emergency accounts are excluded from MFA requirements; that is a Microsoft-specific recommendation for that scenario, not a universal password rule for all identity platforms.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to store and use the credentials
- Use shared, controlled custody. Store credentials in secure locations available to multiple authorized administrators, so access does not depend on one person being present.
- Keep them off personal devices. Do not attach the emergency account to employee-supplied phones or other personal devices.
- Use a designated workstation. Microsoft recommends signing in from a secure, designated workstation, such as a Privileged Access Workstation, rather than an ordinary device.
- Limit access and document handling. Define who may retrieve credentials, under what circumstances, and how their use is recorded. Ensure the custody process remains available during the same outages the account is meant to address.
How to monitor and test readiness
Alert on every use
Configure alerts for all sign-ins and relevant audit activity involving emergency accounts. CISA recommends extensive administrative logging and auditing, as well as detection of anomalous administrative activity. Protect the monitoring path too: an alert is useful only if responders can receive it and investigate during an incident.
Free tools Windows power users keep installed
One-click scans. No signup required.
Every use should trigger an investigation and a record of why access was needed, what actions were taken, and how the account was returned to a ready state. Make sure the responders know how to distinguish a planned test from an actual emergency and how to document both.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Test both accounts on a schedule
Microsoft Learn recommends validating emergency access accounts at least every 90 days; quarterly testing is one example. Test both accounts, and repeat a test after material changes to authentication or Conditional Access. Confirm that each account can sign in through its intended recovery path, that monitoring detects the test, and that no session or exposed credential remains afterward.
A practical review checklist
- At least two emergency accounts exist, are not assigned to individual employees, and have independent recovery paths.
- For Entra, the accounts are cloud-only and their role assignments follow Microsoft’s emergency-access guidance.
- Strong, phishing-resistant authentication is configured and does not rely on the same method as routine administrators.
- Conditional Access does not accidentally make emergency sign-in impossible; exclusions and compensating protections have been reviewed and tested.
- Credentials are held in secure shared custody, personal devices are not used, and responders have a designated workstation.
- All sign-ins and audit activity generate usable alerts, and each use is investigated and documented.
- Both accounts are tested at least every 90 days, with additional tests after relevant configuration changes.
Where the Microsoft guidance applies
The detailed recommendations above about cloud-only accounts, Global Administrator assignments, FIDO2 keys or certificates, Conditional Access, credential storage, and testing are Microsoft Entra guidance. The broader principles—least privilege, administrative logging, audit, and anomaly detection—are also reflected in CISA guidance, including its federal cloud use case. If your organization uses another cloud identity provider, an on-premises directory, or a hybrid configuration, map the same recovery goals to that platform’s current official guidance instead of copying Microsoft role or policy settings.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
