A cloud-only, non-personal account that holds Global Administrator permanently and sits outside Conditional Access, reserved for situations where regular admins can't get in. Microsoft advises having two or more.
Also called break-glass account.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Emergency access account in context, with comparison tables and the common traps.
Terms in this definition
- Global Administrator
The Microsoft Entra role with complete control over the directory. On its own it gives no rights over Azure resources; the holder must elevate access to manage all subscriptions first.
- Conditional Access
Policy engine in Microsoft Entra ID P1 that, depending on signals such as risk or named locations, allows access subject to controls like MFA or a compliant device, or blocks it.
- WHERE
Limits a SELECT, UPDATE or DELETE to just the rows meeting a condition. Omit it, and the statement hits every row.
- Get
Key Vault permission on secrets that allows a single secret to be read; App Service Key Vault references need nothing beyond it.
- HAVING
Applies a condition to groups produced by GROUP BY, often on an aggregate such as SUM(). WHERE works earlier, on individual rows before they are grouped.