Emergency access account
An emergency access account is a protected administrative account reserved for restoring control when normal administrative access is unavailable.
Keep administrative access available during a failure
Emergency access accounts provide a route back into administration when normal accounts cannot be used. Microsoft Entra recommends at least two cloud-only accounts, using phishing-resistant authentication with different dependencies from everyday administrator accounts.
For example, an account that depends on the same unavailable federation service as the normal administrators will not solve that outage. The emergency route has to survive the failure it is meant to cover.
Test the route, including the people who use it
A usable account requires more than working credentials. Authorized staff need access to those credentials, a usable sign-in device, and a procedure they can retrieve during the outage. Microsoft also calls for monitoring and regular validation.
A planned drill should establish that the account can perform the required administrative task and that its use reaches the expected monitoring team. A tabletop can uncover missing custodians or inaccessible instructions, but cannot establish that sign-in works.
Reserve these accounts for emergencies and review each use. They restore administrative control; ordinary account recovery restores a particular user’s ability to authenticate.