> ## Content Index
> Fetch the complete content index at: https://www.myronhelgering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Quick Guide: How to configure a break glass account and alert on sign-in
- URL: https://www.myronhelgering.com/quick-guide-how-to-configure-a-break-glass-account-and-alert-on-sign-in/
- Published: 2024-01-09T22:15:13.000Z
- Updated: 2026-10-17T16:08:34.000Z
- Author: Myron Helgering
- Tags: Microsoft Entra, Quick Guides

In short, we can use a break glass (or emergency access) account to regain access to our Microsoft Cloud environment during critical situations where admin access has been lost or is not possible. Examples of situations are:

- Multi-factor authentication server outage.
- Mistakes while configuring conditional access policies.
- Malicious admin account takeovers.
- Admin users leaving the company.

If you create such an account, it's important to set up an alert rule to receive notifications of any sign-ins.

This post is a quick and efficient guide on how to configure a break glass account and alert on sign-in.

## Creating the break glass account

1. Navigate to the [Microsoft Entra admin center](https://entra.microsoft.com) and **create a new user** account.

![Create break glass account](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/create-break-glass-account.png)

Pick a name that will not reveal this is your break glass account; for example, use a random fake first and last name and make the password long and complex. Microsoft recommends creating two break glass accounts, so if you want, create another one.

1. Assign the **global administrator** role.

![](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/assign-global-administrator.png)

1. Exclude the account from your conditional access policies.

![Exclude break glass account from conditional access policies](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/exclude-break-glass-account-from-conditional-access-policies.png)

1. Now, store the credentials somewhere safely, such as a physical vault, and schedule to test the sign-in regularly.

## Creating and configuring the alert on sign in

1. Navigate to the [Microsoft Azure admin portal](https://portal.azure.com/) and create a new resource group.

![Create a resource group](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/create-a-resource-group-2.png)

1. Create a log analytics workplace and use the resource group as your location.

![Create Log Analytics workspace](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/create-log-analytics-workspace.png)

1. Navigate to the [sign-in events](https://portal.azure.com/#view/Microsoft%5FAAD%5FIAM/SignInEventsV3Blade) page, go to the **Export Data Settings**, and then click the **\+ Add diagnostic setting** button.

![export data settings](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/export-data-settings.png)

1. Configure the sign-in logs to be sent to your log analytics workspace.

![send sign-in logs to log analytics workspace](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/send-sign-in-logs-to-log-analytics-workspace.png)

1. Find your log analytics workspace and click create alert rule

![Create alert rule](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/create-alert-rule.png)

1. Select the **Custom log search** signal name and copy and paste the following query into the query box.

📄

SigninLogs | where UserPrincipalName == 'NAME.LASTNAME@DOMAIN.onmicrosoft.com'

![create custom log search signal](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/create-custom-log-search-signal.png)

1. Set the alert logic **threshold value** to **0**.

![set the treshold value](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/set-the-treshold-value.png)

1. Go to the **actions** section and create a new action group.

![create action group](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/create-action-group.png)

1. Give your action group a **display** and **group name**.
2. Configure your preferred **notifications**, such as e-mail, SMS, voice, or mobile app notifications.

![Configure notifications](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/configure-notifications.png)

1. Complete the creation of your action group.
2. Go to details, set the severity to critical, and give your alert rule a name.

![set alert severity to critical](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/set-alert-severity-to-critical.png)

1. Complete the creation of your alert rule.
2. Sign in to your break glass account to confirm the alert rule and notification are working as expected.

Congratulations, you have successfully created the break glass account and alert rule.

# Quick Guide: How to configure a break glass account and alert on sign in