Every guide to Conditional Access, MFA and identity hardening opens with the same instruction: set up break-glass accounts first. Then it moves on, as if the accounts themselves were the easy part. They are not. A break-glass account done carelessly is worse than none at all, because it gives you the comfort of a safety net while quietly being a hole in the floor. This is the unglamorous detail of getting them right.

A break-glass account, sometimes called an emergency access account, exists for one moment: the day everything else locks you out. A Conditional Access policy goes wrong and nobody can sign in. Your federated identity provider falls over and takes SSO with it. MFA infrastructure has an outage and every normal login is stuck at the second factor. In each case you need a way back into the tenant that doesn’t depend on the thing that broke. That is the entire job.…