Emergency access accounts
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 4f50dfe · +49 −62 lines · also on GitHub
11
---
22
title: Manage emergency access admin accounts
33
description: This article describes how to use emergency access accounts to help prevent being inadvertently locked out of your Microsoft Entra organization.
4
−ms.date: 04/22/2026
4
+ms.date: 02/10/2025
55
ms.topic: how-to
6
−ms.custom: it-pro, sfi-ga-nochange
6
+ms.custom: it-pro, sfi-ga-nochange, sfi-image-nochange
77
ms.reviewer: mwahl
88
---
99
⋯ 23 unchanged lines
3333
3434
:::image type="content" source="./media/security-emergency-access/create-emergency-access-account.png" alt-text="Screenshot of creating an emergency access account in Microsoft Entra ID." lightbox="./media/security-emergency-access/create-emergency-access-account.png":::
3535
36
−1. Choose one of these passwordless authentication methods for your emergency access accounts. These methods satisfy the [mandatory multifactor authentication requirements](../authentication/concept-mandatory-multifactor-authentication.md).
36
+1. Select one of these passwordless authentication methods for your emergency access accounts. These methods satisfy the [mandatory multifactor authentication requirements](../authentication/concept-mandatory-multifactor-authentication.md).
3737
3838
- [Passkey (FIDO2)](../authentication/concept-authentication-passkeys-fido2.md) (Recommended)
3939
- [Certificate-based authentication](../authentication/concept-authentication-passkeys-fido2.md) if your organization already has a Public Key Infrastructure (PKI) setup
4040
41
−1. Register credentials for the authentication method you chose in the previous step.
42
−
43
− - **Passkey (FIDO2)**: [Enable passkeys (FIDO2) for your organization](../authentication/how-to-enable-passkey-fido2.md), then [register a passkey (FIDO2)](../authentication/how-to-register-passkey-with-security-key.md)
44
− - **Certificate-based authentication**: [Configure certificate-based authentication](../authentication/concept-certificate-based-authentication.md)
41
+1. [Configure your emergency access accounts](#configuration-requirements) to use passwordless authentication.
4542
46
−1. Review your Conditional Access policies for administrators and ensure that emergency access accounts are explicitly excluded from all policies, including [phishing-resistant multifactor authentication](../conditional-access/policy-admin-phish-resistant-mfa.md) requirements.
43
+ - [Enable passkeys (FIDO2) for your organization](../authentication/how-to-authentication-passkeys-fido2.md)
44
+ - [Register a passkey (FIDO2)](../authentication/how-to-register-passkey-with-security-key.md)
45
+ - [Configure certificate-based authentication](../authentication/concept-certificate-based-authentication.md)
4746
48
− > [!IMPORTANT]
49
− > Emergency access accounts must be excluded from all Conditional Access policies. Because these accounts are used when normal sign-in methods or policies are failing, a Conditional Access policy could block access at exactly the moment it's needed. Security is instead enforced through the phishing-resistant authentication method registered directly on the account in the previous step.
47
+1. [Require phishing-resistant multifactor authentication](../conditional-access/policy-admin-phish-resistant-mfa.md) for all of your emergency accounts.
5048
5149
1. [Store account credentials safely](#store-account-credentials-safely).
5250
⋯ 23 unchanged lines
7674
7775
## Store account credentials safely
7876
79
−Organizations need to ensure that the credentials for emergency access accounts are kept secure and known only to individuals who are authorized to use them. For example, you might use [FIDO2 security keys](../authentication/how-to-enable-passkey-fido2.md) for Microsoft Entra ID or smartcards for Windows Server Active Directory. Credentials should be stored in secure, fireproof safes that are in secure, separate locations.
77
+Organizations need to ensure that the credentials for emergency access accounts are kept secure and known only to individuals who are authorized to use them. For example, you might use [FIDO2 security keys](../authentication/how-to-authentication-passkeys-fido2.md) for Microsoft Entra ID or smartcards for Windows Server Active Directory. Credentials should be stored in secure, fireproof safes that are in secure, separate locations.
8078
8179
## Monitor sign-in and audit logs
8280
⋯ 19 unchanged lines
102100
103101
1. Sign in to the [Azure portal](https://portal.azure.com) as at least a [Monitoring Contributor](/azure/role-based-access-control/built-in-roles#monitoring-contributor).
104102
105
−1. Search for and open **Monitor**.
106
−
107
−1. In the left menu, select **Alerts**.
103
+1. Browse to **Monitor** > **Log Analytics workspaces**.
108104
109
−1. Select **+ Create** > **Alert rule**. The **Create an alert rule** page opens.
105
+1. Select a workspace.
110106
111
−1. On the **Scope** tab:
112
− 1. In the **Select a resource** pane, find and select your Log Analytics workspace.
113
− 1. Verify that the subscription matches the workspace you configured in the prerequisites.
114
− 1. Select **Apply**.
107
+1. In your workspace, select **Alerts** > **New alert rule**.
115108
116
−1. On the **Condition** tab:
117
− 1. From the **Signal name** drop-down, select **Custom log search**.
118
− 1. Set the **Query type** to **Aggregated logs**.
119
− 1. Under **Search query**, enter one of the following queries, inserting the object IDs of the two emergency access accounts.
109
+ 1. Under **Resource**, verify that the subscription is the one with which you want to associate the alert rule.
110
+ 1. Under **Condition**, select **Add**.
111
+ 1. Select **Custom log search** under **Signal name**.
112
+ 1. Under **Search query**, enter the following query, inserting the object IDs of the two emergency access accounts.
120113
121114
> [!NOTE]
122115
> For each additional emergency access account you want to include, add another `or UserId == "ObjectGuid"` to the query.
123
− >
124
− > The table name in these queries depends on your workspace type. Use `SigninLogs` for standard Log Analytics workspaces, or `AADSignInLogs` for Microsoft Sentinel workspaces.
125116
126117
Sample queries:
127118
```kusto
128119
// Search for a single Object ID (UserID)
129120
SigninLogs
121
+ | project UserId
130122
| where UserId == "00aa00aa-bb11-cc22-dd33-44ee44ee44ee"
131
− | project TimeGenerated, UserPrincipalName, UserId, IPAddress, ResultType, ResultDescription
132123
```
133124
134125
```kusto
135126
// Search for multiple Object IDs (UserIds)
136127
SigninLogs
128
+ | project UserId
137129
| where UserId == "00aa00aa-bb11-cc22-dd33-44ee44ee44ee" or UserId == "11bb11bb-cc22-dd33-ee44-55ff55ff55ff"
138
− | project TimeGenerated, UserPrincipalName, UserId, IPAddress, ResultType, ResultDescription
139130
```
140131
141132
```kusto
142133
// Search for a single UserPrincipalName
143134
SigninLogs
135
+ | project UserPrincipalName
145
− | project TimeGenerated, UserPrincipalName, UserId, IPAddress, ResultType, ResultDescription
146137
```
138
+
139
+ 
147140
148
− 1. Under **Measurement**, set how to summarize the results of the query:
149
− 1. Select the **Measure**.
150
− 1. Select the **Aggregation type**.
151
− 1. Select the **Aggregation granularity**.
152
− 1. Under **Split by dimensions**, select the **Resource ID column**.
153
− 1. Under **Alert logic**:
154
− 1. Set the **Threshold type** to **Static**.
155
− 1. Set the **Operator** to **Greater than**.
156
− 1. Set the **Threshold value** to **0**.
157
− 1. Set the **Frequency of evaluation** to how often you want the query to run.
141
+ 1. Under **Alert logic**, enter the following:
158142
159
− :::image type="content" source="./media/security-emergency-access/alert-logic.png" alt-text="Screenshot of Alert logic settings with example values for Threshold type, Operator, Threshold vlaue, and Frequency of evaluation." lightbox="./media/security-emergency-access/alert-logic.png":::
143
+ - Based on: Number of results
144
+ - Operator: Greater than
145
+ - Threshold value: 0
160146
161
− 1. Select **Next** to proceed.
147
+ 1. Under **Evaluated based on**, select the **Period (in minutes)** for how long you want the query to run, and the **Frequency (in minutes)** for how often you want the query to run. The frequency should be less than or equal to the period.
162148
163
−1. On the **Actions** tab, select an action group to be notified by the alert. If you want to create one, see [Create an action group](#create-an-action-group).
149
+ 
164150
165
−1. On the **Details** tab:
166
− 1. Select the **Severity** of the event. We recommend **0 - Critical**.
167
− 1. Enter the **Alert rule name** and add an optional description.
168
− 1. Select the **Region**.
169
− 1. Select which **Identity** to use when running the log query.
170
− 1. Under **Advanced options**, select **Enable upon creation**.
171
− 1. Select **Next** to proceed.
151
+ 1. Select **Done**. You can now view the estimated monthly cost of this alert.
172152
173
−1. On the **Tags** tab, add any tags you want to associate with the alert rule.
153
+1. Select an action group of users to be notified by the alert. If you want to create one, see [Create an action group](#create-an-action-group).
174154
175
−1. Select **Review + create**, then select **Create**.
155
+1. To customize the email notification sent to the members of the action group, select actions under **Customize Actions**.
176156
157
+1. Under **Alert Details**, specify the alert rule name and add an optional description.
158
+
159
+1. Set the **Severity level** of the event. We recommend that you set it to **Critical(Sev 0)**.
160
+
161
+1. Under **Enable rule upon creation**, leave it set as **yes**.
162
+
163
+1. To turn off alerts for a while, select the **Suppress Alerts** check box and enter the wait duration before alerting again, and then select **Save**.
164
+
165
+1. Select **Create alert rule**.
166
+
177167
### Create an action group
178168
179169
1. Select **Create an action group**.
180170
181
− :::image type="content" source="./media/security-emergency-access/create-action-group.png" alt-text="Screenshot of the Create an action group screen open to the Basics tab." lightbox="./media/security-emergency-access/create-action-group.png":::
171
+ 
182172
183
−1. On the **Basics** tab, enter the following:
173
+1. Enter the action group name and a short name.
184174
185
− - **Subscription** and **Resource group**: Select where the action group will be stored.
186
− - **Region**: Select the region for the action group.
187
− - **Action group name**: Enter a descriptive name.
188
− - **Display name**: Enter a short name (maximum 12 characters) that appears in notifications.
175
+1. Verify the subscription and resource group.
189176
190
−1. Select **Next: Notifications**.
177
+1. Under action type, select **Email/SMS/Push/Voice**.
191178
192
−1. Under **Notification type**, select **Email/SMS message/Push/Voice**.
179
+1. Enter an action name such as **Notify Global Administrator**.
193180
194
−1. Enter a notification name such as **Notify Global Administrator**.
181
+1. Select the **Action Type** as **Email/SMS/Push/Voice**.
195182
196
−1. Select **Edit details**, configure the notification methods and contact information, and then select **OK**.
183
+1. Select **Edit details** to select the notification methods you want to configure and enter the required contact information, and then select **Ok** to save the details.
197184
198
−1. Add any additional notifications you want to trigger.
185
+1. Add any additional actions you want to trigger.
199186
200
−1. Select **Next: Actions** to configure any additional automated actions, or select **Review + create** to finish.
187
+1. Select **OK**.
201188
202189
### Prepare a post-mortem team to evaluate each emergency access account credential use
203190
⋯ 34 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:17 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.