Emergency access accounts

This page's changes and edits · All guidance changes

Microsoft's edit · 18 Apr 00:06 UTC

Update emergency access article - address UUF feedback

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 291ecbe · +17 ~~−17~~ lines · also on GitHub

11 ---

22 title: Manage emergency access admin accounts

33 description: This article describes how to use emergency access accounts to help prevent being inadvertently locked out of your Microsoft Entra organization.

4 −ms.date: 02/10/2025

4 +ms.date: 04/17/2026

55 ms.topic: how-to

6 −ms.custom: it-pro, sfi-ga-nochange, sfi-image-nochange

6 +ms.custom: it-pro, sfi-ga-nochange

77 ms.reviewer: mwahl

88 ---

⋯ 23 unchanged lines

3333

3434 :::image type="content" source="./media/security-emergency-access/create-emergency-access-account.png" alt-text="Screenshot of creating an emergency access account in Microsoft Entra ID." lightbox="./media/security-emergency-access/create-emergency-access-account.png":::

3535

36 −1. Select one of these passwordless authentication methods for your emergency access accounts. These methods satisfy the [mandatory multifactor authentication requirements](../authentication/concept-mandatory-multifactor-authentication.md).

36 +1. Choose one of these passwordless authentication methods for your emergency access accounts. These methods satisfy the [mandatory multifactor authentication requirements](../authentication/concept-mandatory-multifactor-authentication.md).

3737

3838 - [Passkey (FIDO2)](../authentication/concept-authentication-passkeys-fido2.md) (Recommended)

3939 - [Certificate-based authentication](../authentication/concept-authentication-passkeys-fido2.md) if your organization already has a Public Key Infrastructure (PKI) setup

4040

41 −1. [Configure your emergency access accounts](#configuration-requirements) to use passwordless authentication.

41 +1. Register credentials for the authentication method you chose in the previous step.

4242

43 − - [Enable passkeys (FIDO2) for your organization](../authentication/how-to-enable-passkey-fido2.md)

44 − - [Register a passkey (FIDO2)](../authentication/how-to-register-passkey-with-security-key.md)

45 − - [Configure certificate-based authentication](../authentication/concept-certificate-based-authentication.md)

43 + - **Passkey (FIDO2)**: [Enable passkeys (FIDO2) for your organization](../authentication/how-to-enable-passkey-fido2.md), then [register a passkey (FIDO2)](../authentication/how-to-register-passkey-with-security-key.md)

44 + - **Certificate-based authentication**: [Configure certificate-based authentication](../authentication/concept-certificate-based-authentication.md)

4645

47 −1. [Require phishing-resistant multifactor authentication](../conditional-access/policy-admin-phish-resistant-mfa.md) for all of your emergency accounts.

46 +1. Review your Conditional Access policies for administrators and ensure that emergency access accounts are explicitly excluded from all policies, including [phishing-resistant multifactor authentication](../conditional-access/policy-admin-phish-resistant-mfa.md) requirements.

4847

48 + > [!IMPORTANT]

49 + > Emergency access accounts must be excluded from all Conditional Access policies. Because these accounts are used when normal sign-in methods or policies are failing, a Conditional Access policy could block access at exactly the moment it's needed. Security is instead enforced through the phishing-resistant authentication method registered directly on the account in the previous step.

50 +

4951 1. [Store account credentials safely](#store-account-credentials-safely).

5052

5153 1. [Monitor sign-in and audit logs](#monitor-sign-in-and-audit-logs).

⋯ 54 unchanged lines

106108

107109 1. In your workspace, select **Alerts** > **New alert rule**.

108110

109 − 1. Under **Resource**, verify that the subscription is the one with which you want to associate the alert rule.

111 + 1. Under **Resource**, select your **Log Analytics workspace** as the resource type. Verify that the subscription matches the workspace you configured in the prerequisites.

110112 1. Under **Condition**, select **Add**.

111113 1. Select **Custom log search** under **Signal name**.

112114 1. Under **Search query**, enter the following query, inserting the object IDs of the two emergency access accounts.

⋯ 4 unchanged lines

117119 Sample queries:

118120 ```kusto

119121 // Search for a single Object ID (UserID)

120 − SigninLogs

121 − | project UserId

122 + AADSignInLogs

122123 | where UserId == "00aa00aa-bb11-cc22-dd33-44ee44ee44ee"

124 + | project TimeGenerated, UserPrincipalName, UserId, IPAddress, ResultType, ResultDescription

123125 ```

124126

125127 ```kusto

126128 // Search for multiple Object IDs (UserIds)

127 − SigninLogs

128 − | project UserId

129 + AADSignInLogs

129130 | where UserId == "00aa00aa-bb11-cc22-dd33-44ee44ee44ee" or UserId == "11bb11bb-cc22-dd33-ee44-55ff55ff55ff"

131 + | project TimeGenerated, UserPrincipalName, UserId, IPAddress, ResultType, ResultDescription

130132 ```

131133

132134 ```kusto

133135 // Search for a single UserPrincipalName

134 − SigninLogs

135 − | project UserPrincipalName

136 + AADSignInLogs

136137 | where UserPrincipalName == "[email protected]"

138 + | project TimeGenerated, UserPrincipalName, UserId, IPAddress, ResultType, ResultDescription

137139 ```

138 −

139 − ![Add the object IDs of the emergency access accounts to an alert rule](./media/security-emergency-access/query-image1.png)

140140

141141 1. Under **Alert logic**, enter the following:

142142

⋯ 82 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:17 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.