Supporting technical capability
Set up and test emergency administrator access to Microsoft 365.
Create and protect emergency access accounts in Entra ID. Test the agreed recovery scenarios and document when and how your administrators should use them, including any limits.
Illustrative sample · supporting capability
Can emergency access be used and its test observed?
- Observation
- The runbook names an emergency account but lacks a recent controlled sign-in and alert reference.
- Decision
- Emergency access remains unverified.
- Next action
- Agree the authorized test, record its outcome and alert reference, and keep all recovery secrets in restricted storage.
This capability can inform the next service. Its inclusion, price and calendar must be agreed in that service’s scope; following the link does not make it included.
Explore the relevant next serviceTechnical context
When this work applies
- A lockout scare or an audit finding flagged the lack of emergency access.
- You have no documented way back in if Conditional Access or MFA breaks.
- An emergency account exists, but nobody has tested it or set an alert for when it is used.
Possible outputs
Outputs to agree in scope
Emergency Access Runbook
Two emergency accounts, excluded from your Conditional Access rules, protected with hardware keys, alerting on sign-in, and documented.
Tested lockout drill
A simulated lockout proving the accounts actually work.
Alerting on use
Sign-in alerting configured so a break-glass sign-in raises an alert to the destination your team names.
Commercial & delivery basis
The scope and conditions of the work.
Delivery window
This supporting capability has no separate confirmed delivery window. The proposal names its scope and calendar.
Capability scope to confirm
- Two emergency access accounts
- Conditional Access exclusion and hardware-key protection
- Sign-in alerting
- Tested runbook
Scope assumptions
- One Microsoft Entra ID tenant
Exclusions
- Broad identity redesign
- Privileged access management rollout
- Hardware security key purchase
- Watching the alert once it is configured, which stays with your team or your monitoring provider
Required access
- Entra ID admin access
- Two hardware security keys
- A 30-minute kickoff with IT
Acceptance
The agreed completion standard.
The engagement is complete when the two accounts are created, protected, tested, and the runbook is delivered.
Discuss the work
Tell us what you need to change.
Share the systems involved, why the change is needed and your deadline. We clarify the work, responsibilities and information needed for a proposal.
Discuss this project