Creating and managing break-glass accounts
As we continue to secure our identities with security and governance features, such as Multi-Factor Authentication, Conditional Access policies, Identity Governance, and PIM solutions, it is important to make sure that we do not mistakenly get locked out of Azure AD. To protect against potential lockout and to make sure that access is still available in a potential emergency situation, you should configure at least two emergency-access or break-glass accounts. These accounts are accounts of high privileges with access at the level of a global administrator. These accounts are not protected with Multi-Factor Authentication, meaning that they can gain access quickly to resources when other administrator accounts cannot gain access. They should also be excluded from all Conditional Access policies. The use of these accounts should be limited to this scenario and the credentials should be locked away and kept in a secure location, such as a password...
