Accès conditionnelPublished on June 21, 20265 min read
Break-glass account: why (and how) to exclude it from Conditional Access
An emergency-access account keeps you from locking yourself out of your tenant. Here is how to create, protect and exclude it from your Conditional Access rules.
A poorly calibrated Conditional Access rule can lock every administrator out of the tenant — including whoever created it. The break-glass account is the universal safeguard, recommended by Microsoft.
The rules of a good break-glass account
- A dedicated, non-personal cloud account reserved for emergencies.
- A long password, stored offline in a safe place.
- Excluded from all Conditional Access rules.
- Monitored: any sign-in should trigger an alert.
The classic mistake is forgetting to exclude it from a new rule. AuPoint remembers your break-glass account and automatically injects it into the exclusions of every Conditional Access rule you deploy.
Set up your emergency account once, and deploy your rules with peace of mind.