Break-glass Account Health

The question it answers: Does the tenant have usable emergency-access accounts, and does each follow Microsoft’s guidance?

Emergency-access accounts are the way back in when Conditional Access, MFA or federation breaks. An account is listed when it is a Global Administrator excluded from an all-user Conditional Access policy, or when its name looks like an emergency account. Each one is checked against Microsoft’s emergency access guidance.

Note

Group-based CA exclusions use the full transitive membership of every group a CA policy references; Global Admin via a group uses the full membership of role-assignable groups.

At a glance

Where in the app	Entra ID › Security › Break-glass Account Health
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra ID P1 for the ‘last tested’ column (sign-in activity). The rest works without it.
Report id (API and MCP)	entra.security.break-glass-accounts

Columns

Column	Key	Type
Account	DisplayName	Link
UPN	UserPrincipalName	Text
Status	Status	Status
Findings	FindingsString	Text
Detected by	DetectedBy	Text
Global Admin	GlobalAdminVia	Text
Cloud-only	IsCloudOnly	YesNo
Excluded from CA	ExcludedFromCount	Text
Methods	MethodsRegistered	Text
Last sign-in	LastActivityDateTime	Date
Password age (days)	PasswordAgeDays	Number

What it needs

Licence: Microsoft Entra ID P1 for the ‘last tested’ column (sign-in activity). The rest works without it.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
User.Read.All	Microsoft Graph	Read all users’ full profiles
User-LifeCycleInfo.Read.All	Microsoft Graph	Read all users’ lifecycle information
Group.Read.All	Microsoft Graph	Read all groups
RoleManagement.Read.Directory	Microsoft Graph	Read all directory RBAC settings
Policy.Read.All	Microsoft Graph	Read your organization’s policies
AuditLog.Read.All	Microsoft Graph	Read all audit log data

Data sources it reads

• GET /v1.0/users
• GET /v1.0/roleManagement/directory/roleAssignments
• GET /v1.0/identity/conditionalAccess/policies
• GET /v1.0/groups/{id}/transitiveMembers (CA-referenced and role-assignable groups)
• GET /v1.0/reports/authenticationMethods/userRegistrationDetails
• GET /v1.0/users?$select=signInActivity

Through the API and MCP

GET /ir-api/v1/reports/entra.security.break-glass-accounts?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.security.break-glass-accounts. The client needs the Read grant for Entra ID. See Using the API.