Hey everyone. We're setting up 'break glass' accounts for emergencies in Entra ID. We followed the docs: separate global admin accounts, long passwords, no MFA on them.
But the system keeps flagging them for 'risky sign-ins' and automatically blocking them! 😕 This seems to defeat the whole purpose. We're worried we'll get locked out during a real crisis.
Are we doing something wrong? Is there a specific policy or setting we need to adjust for these emergency accounts? How do you all handle this?
still learning
Learning the ropes
You've hit the classic break glass paradox. Following the base documentation creates an account that behaves exactly like a compromised one - it sits unused, then suddenly logs in from an unknown location/device with high privileges and no MFA. To the system, that is *the* definition of risk.
The key adjustment isn't on the account itself, but in your Conditional Access or Identity Protection policies. You need to create a named location, like your corporate HQ or a secured VPN endpoint, and then exclude sign-ins from that location from your risky sign-in policies. The break glass account should *only* ever be used from that designated, trusted location during a true emergency. This reduces the false positive.
You must also maintain a strict operational procedure: the credentials are stored offline in a physical safe, and any access is logged and reviewed post-incident. Without that, you're just creating a huge security hole.