emergency access ("break glass") account procedure
Procedure for using emergency break-glass accounts when normal admin access is unavailable. Covers when to use, how to access, and mandatory post-use review. Use only in genuine emergencies. Not for routine admin work.
TL;DR
Break-glass accounts are for when all normal admin paths are down (IdP outage, lockout of all admins). Use requires incident-commander approval, the credentials come from sealed storage, and every use triggers a mandatory post-incident review with credential rotation afterward.
The error
(Emergency; no error. Normal admin access unavailable.)Steps
- Confirm it is a genuine break-glass situation: all normal admin access paths are unavailable. Expected: confirmed by the incident commander. "Inconvenient" is not "unavailable".
- Retrieve the credentials from sealed storage (safe, sealed envelope, or split-knowledge vault) with two people present. Expected: retrieved and logged. The retrieval itself is audited.
- Use the account only for the specific recovery action needed. Expected: minimal use. Do not browse, do not "fix other things while in there".
- Immediately after: rotate the break-glass credentials and re-seal them. Expected: rotated. A used break-glass credential is burned.
- Hold the post-incident review: what failed, why break-glass was needed, what prevents recurrence. Expected: review documented. Every break-glass use indicates a resilience gap.
When to use
- IdP outage blocking all admin access
- All admin accounts locked or compromised
When not to use
- Routine administration
- Convenience ("faster than PIM")
Compatibility
- Any identity system; the procedure is universal
Variants
Cloud break-glass
Entra ID emergency access accounts, excluded from Conditional Access and MFA policies by design, monitored with alerts on any sign-in.
On-prem break-glass
Domain admin account with a sealed password, same controls.
Why it happens
Every access control system can fail closed against its own administrators. Break-glass is the deliberately-designed exception, and its controls (sealed storage, mandatory review) keep the exception from becoming the rule.
Edge cases
- Test break-glass access annually in a drill; an untested emergency account may not work.
- Alert on ANY break-glass sign-in; it should never happen quietly.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_DovRkIXZwrz4xJ3mO1AIsA