Direct answer
Maintain documented, restricted and tested emergency access appropriate to the environment, including how to recover if ordinary device or identity policies prevent administrative sign-in.
Define failure scenarios
Identify who can respond when identity services, a policy deployment, device management or a hardware component fails. Map emergency identities and local device recovery to the services they can restore, and document owners, storage and escalation contacts.
Protect and monitor
Limit who can retrieve emergency credentials, maintain a secure recovery procedure and alert on their use. Microsoft recommends considering emergency access account exclusions when deploying its example Conditional Access policy to avoid policy-related lockout; the organization must protect and monitor those accounts separately.
Reference: Microsoft: Require device compliance and emergency access.
Exercise recovery
Run an approved controlled exercise without exposing secrets or interrupting users. Verify that the expected administrators can recover access, log the exercise and review policy impact. Update the plan after staff, directory, hardware or credential changes.
Exercise an identity outage
Use a nonproduction scenario in which a policy error blocks ordinary administrative sign-in. Verify who can obtain the emergency credential, how the action is logged and which team can restore the policy. Record elapsed time and access gaps without exposing the credential or weakening normal production authentication.
Assessment limits
One emergency account or device procedure may not restore every service. Availability and provider behavior depend on the identity and management architecture.
Frequently asked questions
Should emergency credentials be shared widely?
No. Restrict retrieval, audit use and follow the organization's approved recovery process.
Does an excluded account need monitoring?
Yes. Exclusions reduce lockout risk but create a sensitive access path that needs protection and oversight.
Is a documented procedure enough?
Exercise it safely and review the result so it works when ordinary access is unavailable.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.