Field Notes · Sheet 13 / 30 · Privileged access
Emergency access accounts
Microsoft's current checklist for emergency access accounts in Entra ID, and the item most often skipped: an alert on every sign-in.
Bradley Baker · · 1 min read
Two accounts in your tenant should never sign in. When one does, the right people should know within minutes. This is the longer version of Sheet 13.
The checklist
Microsoft's current guidance for emergency access accounts, as of October 2026:
- Two or more of them.
- Cloud-only, on your onmicrosoft.com domain, never federated or synced from on-premises.
- Global Administrator assigned active and permanent in PIM, not eligible.
- Phishing-resistant sign-in. A FIDO2 passkey is Microsoft's recommendation, or certificate-based authentication if you already run PKI. Both satisfy mandatory MFA.
- Excluded, through a dedicated group, from Conditional Access policies that block or restrict sign-in. Report-only policies don't need the exclusion.
- An alert on every sign-in, sent to more than one administrator.
- Credentials stored in separate secure locations and not tied to any one person.
- Checked at least every 90 days, with a test sign-in every quarter.
Item 3 is the one exception to the rest of this set. Sheet 11 is about keeping every other admin eligible instead of active.
The item people skip
The alert is the item people skip. An emergency account that can sign in without anyone noticing is just an unmonitored Global Administrator.
The exclusion group in item 5 is the same one Sheet 10 adds to each Secure foundation template.
When did someone last test an emergency access sign-in in your tenant?
Sources
- Manage emergency access admin accountslearn.microsoft.com
- Emergency access
- Entra ID
- Global Administrator
- Passkeys
- Conditional Access