Break glass account has a FIDO2 security key registered

​

What this check verifies

Microsoft Entra break glass (emergency access) accounts should have at least one FIDO2 security key registered as their authentication method. These accounts are identified as users excluded from all enabled Conditional Access policies.

​

Risk

Without FIDO2 security keys, break glass accounts rely on weaker authentication methods vulnerable to phishing, credential theft, and man-in-the-middle attacks. Compromised emergency access accounts could grant an attacker unrestricted tenant access, bypassing all Conditional Access protections.

​

Recommendation

Register at least one FIDO2 security key for each break glass account. Store the physical keys in a secure, offline location such as a safe. Use phishing-resistant authentication to protect emergency access accounts from credential-based attacks.

​

Remediation

Dashboard steps

1. Navigate to Microsoft Entra admin center > Users.
2. Select the break glass account.
3. Go to Authentication methods > Add authentication method.
4. Select FIDO2 Security Key and follow the registration steps.
5. Store the physical FIDO2 key in a secure location (e.g., physical safe).

​

References

• https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access
• https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passwordless#fido2-security-keys

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_break_glass_account_fido2_security_key_registered. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks