## TL;DR
Break-glass accounts are for when all normal admin paths are down (IdP outage, lockout of all admins). Use requires incident-commander approval, the credentials come from sealed storage, and every use triggers a mandatory post-incident review with credential rotation afterward.

## The error
```text
(Emergency; no error. Normal admin access unavailable.)
```

## Steps
1. Confirm it is a genuine break-glass situation: all normal admin access paths are unavailable. Expected: confirmed by the incident commander. "Inconvenient" is not "unavailable".
2. Retrieve the credentials from sealed storage (safe, sealed envelope, or split-knowledge vault) with two people present. Expected: retrieved and logged. The retrieval itself is audited.
3. Use the account only for the specific recovery action needed. Expected: minimal use. Do not browse, do not "fix other things while in there".
4. Immediately after: rotate the break-glass credentials and re-seal them. Expected: rotated. A used break-glass credential is burned.
5. Hold the post-incident review: what failed, why break-glass was needed, what prevents recurrence. Expected: review documented. Every break-glass use indicates a resilience gap.

## When to use
- IdP outage blocking all admin access
- All admin accounts locked or compromised

## When not to use
- Routine administration
- Convenience ("faster than PIM")

## Compatibility
- Any identity system; the procedure is universal

## Variants
### Cloud break-glass
Entra ID emergency access accounts, excluded from Conditional Access and MFA policies by design, monitored with alerts on any sign-in.
### On-prem break-glass
Domain admin account with a sealed password, same controls.

## Why it happens
Every access control system can fail closed against its own administrators. Break-glass is the deliberately-designed exception, and its controls (sealed storage, mandatory review) keep the exception from becoming the rule.

## Edge cases
- Test break-glass access annually in a drill; an untested emergency account may not work.
- Alert on ANY break-glass sign-in; it should never happen quietly.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_DovRkIXZwrz4xJ3mO1AIsA