Enterprise Identity & Access Management Platform · View 26 of 27 · Assurance

Break-Glass & Identity Recovery

The path that exists precisely because every other path has failed.

Editable source SVG draw.io All views

Two accounts, not one and not six. One is a single point of failure during an incident; six is a standing privilege problem.
Credentials are split and sealed offline, retrieved under a two-person rule with a witness. The control is procedural, and that is stated rather than dressed up as technical.
Every break-glass sign-in raises a P1 alert with no exception path. An emergency account nobody notices being used is an attacker's account.

Quarterly rehearsal: sign in, confirm the account still works, confirm the alert fires, re-seal. RTO for tenant-level recovery is 4 hours because it has been measured, not estimated.
Recovery re-applies configuration from the IaC repository rather than reconstructing it by hand, which is the main reason view 21 exists.
The Managed HSM security domain is held under the same custody procedure. Losing it is unrecoverable, so it is part of the same rehearsal.

These accounts are excluded from all Conditional Access policies except one requiring a FIDO2 hardware key, so a stolen hardware key plus vault access is the whole attack.
If break-glass itself fails, the only remaining path is Microsoft support escalation, which is measured in hours and is outside our control.
The rehearsal is the control that decays first. It is a calendared, owned commitment; a missed quarter is a reportable risk, not an administrative slip.