IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Break-glass & privileged access
It is 2 a.m. and the identity provider is down. Zara must get in anyway. Your goal: explain how a break-glass account works and how to keep it safe.
- Break-glass is an emergency account that works when the IdP is down.
- Guard it: split secret, alert on every use, time limit, recording.
- Just-in-time admin means no standing power to steal.
- After use, rotate the secret, read the log, file the story.
The 2 a.m. problem
Zara's pager goes off. The identity provider is failing. The admin console she needs is behind that same identity provider. The fix needs the very thing that is broken. This is a circular lockout. You need a way in that does not depend on the broken system. With none, the team is locked out for hours. With a careless one, a shared password sits on a sticky note for years. See also detection and response.
The break-glass account
A break-glass account is an emergency identity that works on its own. It is not federated. It does not depend on the normal IdP, the usual MFA path or the directory. But an account with no dependencies is also a standing skeleton key: a key that opens every door. So you fence it in.
The red glass box on a wall that holds a fire axe. You may break it when you must. But the bell rings for everyone, and afterwards someone has to put new glass in.
Not federated must never mean not guarded. A safe account has these parts. The secret is long, random and split, so no one person holds all of it. For example, print it in two sealed envelopes. Two people keep one each, in two different safes. Any use sends an alert. Access has a time limit and ends by itself. The session is recorded and fully audited. Leave it out of federation, but never out of watching.
Standing admin or just-in-time
The wider habit is privileged access management (PAM). Its main move is to end standing privilege. These are admin rights that sit on an account all day, waiting to be stolen. Instead you use just-in-time (JIT) elevation. You hold no admin power until you ask for it and get approval. You use it briefly, then drop back. If a phisher steals a JIT admin's password, they get no admin power.
Dual control (four eyes) means a second person must approve before the elevation opens. It is like a company cheque that needs two signatures. Session recording makes the audit a replay.
The cleanup ritual
The incident is over when the glass is whole again, not when service is back. Do three steps, in order. First, rotate the credential. Whoever used it saw the secret, so it is burned. Make a new one before it goes back in the safe, or a live skeleton key stays outside. Second, review the log. Read back the recording while it is fresh. Third, file the story: why it was opened, who approved it and what was done.
Sam, the on-call lead, approves Zara's request over a separate channel. Only then does she unseal break-glass, and the alert goes to the team. A recorded session with a time limit opens. She restores the IdP. Then she does the three cleanup steps.
Break-glass is itself a non-human identity of the most dangerous kind. Send its alarm to your identity telemetry and SIEM as a top-priority signal.
Go deeper: What public guidance recommends
- Keep two or more emergency accounts, so one lost key is not a lockout.
- Do not make them depend on federation or on the same sign-in methods as normal admins.
- Use a phishing-resistant method, such as a FIDO2 security key kept offline in a secure place. Store copies in separate locations.
- Make sure no rule that blocks sign-in applies to them, or the account fails in the emergency. Protect them with the strong credential instead.
- Alert on every sign-in, and test the accounts on a schedule, for example every 90 days. After each use, hold a review.
This follows public guidance from large cloud providers. The OWASP Logging Cheat Sheet also lists use of break-glass accounts as a high-risk event to log. For the incident itself, NIST SP 800-61 Revision 3 (April 2025) replaced Revision 2. It ties incident response to the NIST Cybersecurity Framework 2.0 and stresses learning from each incident.
🧪 Interactive lab — enable JavaScript to play with this one.
Designing break-glass and privileged-access controls for real? Talk to our team about PAM, dual control and emergency-access playbooks.