Lion Cipher Lab
Design break-glass emergency access accounts (the last-resort admin login)
- Identity & Access Management
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Every serious security programme eventually runs into the same paradox. You spend months making it hard to get administrator access — you require multi-factor authentication, you route logins through a single identity provider, you add conditional-access rules that block sign-ins from unmanaged devices. And then one day the multi-factor service has an outage, or the identity provider goes down, or the last person with the top admin role leaves, or a conditional-access rule you wrote yesterday locks everyone out. Now nobody can get in to fix anything — including the outage itself. The…
What you'll learn
- what break-glass / emergency access means
- designing a last-resort admin account safely
- why break-glass accounts are excluded from conditional access
- phishing-resistant credentials for emergency accounts
- split-knowledge / sealed credential storage
- alerting on any use of a highly-privileged account
- AWS root user hardening and root-usage alerts
- Microsoft Entra emergency access accounts and sign-in alerts
- writing and testing a break-glass procedure
Steps in this lab
- What break-glass actually means (five plain definitions)
- When you would actually reach for it — the real outage scenarios
- The core paradox: it must escape the controls that protect everything else
- Pick your target and create the account safely
- Store the credentials so no single person — or single failure — controls them
- Exclude it from the lockout controls — carefully, and in a group
- The heart of it: an alert that fires the moment the account is used
- Write the procedure — when it may be used, by whom, and exactly how
- Test it like you mean it — the drill and the schedule
- Why this is a signal you operate real systems