Break-glass account

What it means

A break-glass account is a highly privileged login kept for emergencies, such as when single sign-on is down or every normal administrator is locked out. Like the fire alarm it is named after, it stays untouched until the day it is really needed.

Because it can do almost anything and may sit outside normal controls, it is treated differently. Its credentials are stored securely offline, access is restricted to a few named people, and every use triggers an alert that someone has to explain afterwards.

Why it matters

Without one, an outage in your identity system can leave nobody able to fix it, and a locked-out team loses hours when it can least afford to. With a badly managed one, you have a permanent master key that skips your multi-factor authentication and sits in a password manager nobody reviews.

Attackers look for exactly this kind of account, because one login gives them everything and often leaves little trace. Microsoft's guidance for its identity service, for example, advises limiting these accounts, protecting them with strong credentials, and alerting whenever one signs in.

How it shows up

You meet it as the shared admin password in a vault, a cloud root account, or a database superuser reserved for incidents. A sound set-up keeps it separate from daily work, uses long unique credentials, tests it on a schedule, and sends an alert to several people when it is used.

The mistakes are familiar. It gets used for routine jobs because it is convenient. Its password is known to people who have left. Nobody reviews the alerts, or nobody tested it until the emergency. Check that use is logged to an audit log and that credentials rotate afterwards.