Definition
A Break-Glass Account is an emergency administrative account used only when standard authentication systems fail or during critical incidents, providing last-resort access with strict monitoring and documentation requirements.
People Also Ask
Common questions about Break-Glass Account answered by our security experts.
Break-Glass Account in Practice
A break-glass account is an emergency credential held for situations where normal access paths have failed — the identity provider is unavailable, conditional access has locked everyone out, or the privileged access system itself is down.
It exists precisely because every other control can fail, and it is therefore deliberately exempt from most of them. That exemption is what makes it both necessary and dangerous.
Why they are required
Centralising authentication creates a single dependency. If the identity provider is unreachable, nobody can sign in — including the administrators who would fix it. A conditional access policy misconfigured to exclude everyone produces the same result, and it has happened to large organisations.
Cloud platforms explicitly recommend maintaining emergency accounts excluded from conditional access for this reason. Without one, a recoverable configuration error becomes an outage requiring vendor intervention.
Protecting an account that is exempt by design
The credential should be long, random, and split so that no single person can use it alone — typically two halves held by different people, stored physically in separate sealed locations.
It should be excluded from conditional access but not from monitoring. Any authentication by a break-glass account should generate an immediate, high-priority alert to multiple people, because legitimate use is rare and unauthorised use is an emergency.
And it should be tested. An emergency credential that has never been used may have expired, been disabled by a policy sweep, or lost its permissions to a role change nobody connected to it.
The procedure matters as much as the account
Who may authorise use. Who retrieves which half. What must be recorded. What happens afterwards — because the credential must be rotated and resealed once the emergency ends, and that step is the one most often skipped.
Without a written procedure, the account is either unusable when needed because nobody knows the process, or used casually because it is convenient.
Cloud root accounts are the same problem with a different name
Every cloud account or subscription has a founding identity that cannot be removed and that holds rights no role assignment can deny. It is a break-glass account whether or not anyone treats it as one, and it is frequently tied to an individual person’s email address from whenever the account was first created.
The correct handling is the same as any emergency credential: a hardware second factor stored physically, a monitored distribution address rather than a personal mailbox, no access keys at all, and alerting on any use. The common failure is that the registered address belongs to someone who has left, which means password recovery for your most privileged identity routes to a mailbox nobody controls.
Where to start
Establish whether you have one, whether anyone has verified it works this year, and whether its use would generate an alert. All three are frequently no.
See privileged access management. GuardsArm runs security program reviews.
Related Terms
Privileged Access Management
Privileged Access Management (PAM) is a cybersecurity discipline that secures, controls, and monitors access for privileged accounts that have elevated permissions to critical systems and data.
Incident Response
Incident response is the organized approach to addressing and managing the aftermath of a security breach or cyberattack. The goal is to handle the situation in a way that limits damage, reduces recovery time and costs, and prevents future incidents.
Access Control
Access control is a security mechanism that regulates who or what can view, use, or interact with resources in a computing environment. It enforces policies that grant or deny permissions based on user identity, role, or other attributes.
Related Reading
Privileged Access Management: Vaults, Secrets and Machine Identities
Most PAM programmes secure human administrators and ignore the service accounts, which outnumber them heavily and never change their passwords.
Privileged Session Recording: When and How to Use It
Recording administrative sessions is powerful, intrusive and frequently deployed badly. Where it earns its place, where it does not, and the privacy…
In-House or Retained Incident Response: Choosing Before You Need To
The decision is not either/or. What you can realistically handle internally, when to call, and why the contract has to exist before the incident.
Speak With an Expert
Book a free consultation to discuss break-glass account for your organization.
Related Services
Need Help With Break-Glass Account?
Our certified security professionals can help you implement the right break-glass account strategy for your organization. Get a free assessment today.
Book a Free Consultation