Break-glass accounts in Microsoft 365: how IT management keeps a company from losing its administrator

• Number At least two accounts, according to Microsoft.
• Nature Cloud-only (.onmicrosoft.com domain), not tied to people or phones.
• Authentication Physical security key (FIDO2) or certificate; Microsoft’s mandatory MFA also applies to these accounts.
• Control An alert on every use and a test at least every 90 days and whenever the IT team changes.

No attack is needed. In the environments we review, the scenarios repeat themselves:

1. Single second factor — the only administrator’s phone was lost or replaced.
2. Faulty conditional access — a rule such as “only from Portugal” or “only on company computers” locked everyone out, including whoever created it.
3. Administrator leaves — an employee or the previous provider left and took the credentials.
4. Compromised account — the attacker changed the password and the authentication methods.

The question is always the same: who can get in now, without relying on the account that failed? Think of the hammer behind glass in a railway carriage: nobody uses it day to day, everyone knows where it is, and breaking the glass sets off an alarm.

Microsoft’s documentation on emergency access accounts in Microsoft Entra — the Microsoft 365 identity system — sets out the following:

For years, the emergency account was a long password kept in an envelope. That no longer works: Microsoft now requires MFA on its admin portals — in the Microsoft 365 admin centre since February 2025 — and the documentation states explicitly that emergency accounts are no exception.

The recommended methods are a FIDO2 key or a certificate. For an SME, the simplest option is two physical keys per account, in different locations. Method comparison: MFA in the company, method by method.

This is a management decision. In the IT management we provide, the provider works with named admin accounts, one per engineer; the emergency accounts stay with the client. That way the company is never held hostage by anyone — not even by us.

• Key 1 In the company safe, accessible to the board.
• Key 2 Elsewhere: another office, a director’s safe or a bank safe deposit box.
• Written record Who has access, where they are, date of the last test.
• Associated passwords In a business password manager, in an area restricted to the board.

It is also a clause to confirm in any contract: provider exit and return of data and access.

1. Are there at least two emergency accounts on .onmicrosoft.com?
2. Is none of them linked to a person or a personal phone?
3. Do they use a physical key or certificate, rather than SMS or an app?
4. Are they excluded from blocking conditional access rules?
5. Does the board know where the keys are, in separate locations?
6. Does every sign-in trigger an immediate alert?
7. Have they been tested in the last 90 days?
8. Does each engineer use their own admin account?

Two or more “no” or “don’t know” answers mean real risk. Many of the failures we find in Microsoft 365 email security start with administration.

At the União das Freguesias de Massamá e Monte Abraão, DataRoad migrated around 50 mailboxes to Exchange Online, with full transfer of content, reconfiguration of workstations and phones, and final validation. At a public body, administration of the environment must remain with the body, whoever the provider is. That is the model we apply: named accounts for engineers, emergency accounts held by the client, a clear access record.

• Microsoft Learn — Manage emergency access admin accounts
• Microsoft Learn — Mandatory multifactor authentication

We review admin accounts, emergency accounts, authentication methods and access rules, and deliver the fixes by priority in a no-obligation proposal. More than 10 workstations · support contract · remote, on-site and telephone support. Find out more about managed Microsoft 365 and the IT Unlimited plans.