Most firms I sit down with can't answer this: if nobody can log in to your Microsoft 365 tomorrow morning, who gets you back in?
Usually there's a long pause.
The answer is supposed to be a break-glass account. Two of them, actually. Emergency admin logins that live only in Microsoft's cloud, belong to no individual, and sit in a safe until the day you need them. It's the spare key taped under the drawer — not for daily use, for the day the locksmith doesn't pick up.
Here's what's catching firms off guard right now. Microsoft now requires multi-factor sign-in on its admin portals, and emergency accounts are not exempt. The old setup — one enormous password, excluded from every policy — quietly stopped working. Microsoft's own guidance now points to a security key or a certificate instead.
So a lot of firms are holding a spare key that no longer turns, and won't find out until the morning they need it.
For a 15-attorney practice, a day locked out of email and client files isn't an IT problem. It's a day of billable hours you don't get back and a dozen awkward phone calls.
Two accounts. Credentials in a safe. Tested every quarter. A spare key you've never turned is just a guess.
Worth a look before your next cyber renewal.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email