Break Glass Access

What is break glass access?

Break glass access is a pre-arranged emergency route into a critical system, used when normal authentication is unavailable. The name comes from the alarm you smash the glass to reach. In identity practice it means a small number of highly privileged accounts, deliberately excluded from the usual policies and kept sealed until an outage or an incident makes them necessary.

How break glass access is designed

• At least two emergency accounts exist, so a single failure cannot lock everyone out.
• They are cloud-only and independent of the on-premises directory and of any federation service.
• They are excluded from the conditional access policies that could themselves cause the lockout.
• Credentials are split or vaulted, often with each part held by a different person.
• Every use triggers an immediate alert and a documented post-incident review.

The trap: excluded from policy usually becomes excluded from everything

Exempting these accounts from conditional access is correct. The failure is that the exemption quietly spreads to the rest of the control environment: they end up outside MFA campaigns, outside password rotation, and outside the access review. An account holding permanent global admin rights that nobody ever reviews is exactly the finding an auditor is looking for.

Examples and use cases

A company loses its federation service to a certificate expiry and cannot authenticate anyone. Two break glass accounts, stored in a sealed envelope in the safe with the password split between the CTO and the head of IT, restore administrative access within minutes. The following week the credentials are rotated, the use is documented, and both accounts reappear in the quarterly review. That last step keeps the control healthy, and it only happens when those accounts sit in the same inventory as everything else, which is what Corma maintains.

Related concepts

• Identity and access management platform
• IAM for security teams
• IT workflow builder

FAQ

How many break glass accounts should a company have?

At least two, so that one failure or one unavailable person cannot cause a total lockout. Microsoft recommends two emergency access accounts for Entra ID tenants.

Should break glass accounts use MFA?

Yes, but with a method independent of the systems that could fail, such as a hardware security key rather than an app tied to the corporate device fleet.

How are break glass credentials stored?

In a sealed physical envelope or a dedicated vault, usually split between two holders so no single person can use the account alone.

What happens after a break glass account is used?

The credentials are rotated immediately, the use is documented with a reason and a timeline, and the incident is reviewed to remove whatever caused the lockout.

Request a demo