Recover Admin Account With Entra Break Glass Access Application

A break glass account is essential for emergency access, but what happens when it fails? Missteps like accidental deletion, MFA outages, or Conditional Access misconfigurations can lock you out. To ensure a reliable recovery path, every tenant should have a break glass access application in Entra ID.

Why Use a Break Glass Access Application?

✅ Stable Recovery Path – Remains functional as long as its certificate is valid.
✅ Non-Interactive Access – Recovery tasks can be executed via scripts or API calls.
✅ Conditional Access Bypass – Not affected by MFA or policy exclusions.

🔗 Read the full guide here

You Should Know: Setting Up a Break Glass App in Entra ID

Step 1: Register the Application

 PowerShell: Register a new Entra ID application 
Connect-MgGraph -Scopes "Application.ReadWrite.All" 
New-MgApplication -DisplayName "BreakGlassApp" -SignInAudience "AzureADMyOrg"

Step 2: Assign Necessary Graph Permissions

 Assign Directory.ReadWrite.All (or custom permissions) 
$params = @{ 
ResourceAppId = "00000003-0000-0000-c000-000000000000" 
ResourceAccess = @( 
@{ 
Id = "741f803b-c850-494e-b5df-cde7c675a1ca"  Directory.ReadWrite.All 
Type = "Role" 
} 
) 
} 
Update-MgApplication -ApplicationId <AppId> -RequiredResourceAccess $params

Step 3: Generate and Assign a Certificate

 Linux: Generate a self-signed certificate 
openssl req -x509 -newkey rsa:2048 -keyout breakglass.key -out breakglass.crt -days 365 -nodes -subj "/CN=BreakGlassApp"

Step 4: Test Access via Graph API

 Use curl to verify access 
curl -X GET "https://graph.microsoft.com/v1.0/users" \ 
-H "Authorization: Bearer $(az account get-access-token --resource https://graph.microsoft.com --query accessToken -o tsv)"

Step 5: Secure the Application

Store certificates in Azure Key Vault.
Restrict access using Privileged Identity Management (PIM).
Monitor sign-ins via Azure AD Audit Logs.

What Undercode Say

A break glass app is a Tier 0 asset—protect it like one. Ensure:
– Certificate rotation every 6-12 months.
– No interactive logins allowed.
– Strict IP restrictions for API access.

For additional security, use:

 Linux: Check certificate expiry 
openssl x509 -in breakglass.crt -noout -enddate

Windows: Verify service principal permissions 
Get-AzureADServiceAppRoleAssignment -ObjectId <ServicePrincipalId>

🔗 Microsoft Graph Permissions Reference