Plan and implement emergency access for DevOps platforms
Implementation Effort: Medium – Creating break-glass accounts for GitHub, Azure DevOps, and Entra ID, excluding them from lockout dependencies, and scheduling recurring tests takes coordinated planning. User Impact: Low – Break-glass accounts are reserved for administrators during outages; normal users never touch them and are not affected. Lifecycle Stage: Govern
Overview
Establish and test emergency access accounts — also called break-glass accounts — for GitHub, Azure DevOps, and Microsoft Entra ID so your organization can restore administrative control if primary authentication paths fail. Break-glass accounts are dedicated highly privileged identities reserved exclusively for scenarios where normal administrative sign-in has failed, such as identity provider outages, misconfigured Conditional Access policies, or lost MFA devices. These accounts should never be used for routine administration and should be tested on a regular schedule.
Use Microsoft Entra emergency access accounts as the primary recovery path for Entra-backed Azure DevOps. For GitHub Enterprise Managed Users, sign-in depends entirely on Microsoft Entra ID. In the event of IdP unavailability, recovery options include: (1) Microsoft Entra emergency access accounts as the primary path, (2) the EMU setup user's stored recovery codes and the enterprise's SSO recovery codes that administrators download during initial configuration, and (3) documented enterprise support escalation procedures. Test these recovery paths regularly and maintain offline documentation.
For GitHub Enterprise Cloud organizations using standard SAML SSO, document and test the organization's recovery path for owner access during an identity outage. Store long, complex passwords offline in secure physical locations with documented access procedures. Exclude emergency accounts from normal Conditional Access dependencies that could create lockout.
DevOps platforms like GitHub and Azure DevOps concentrate enormous power in a small number of administrative accounts. Organization owners and project collection administrators can modify security settings, change repository visibility, alter pipeline definitions, and manage identity federation.
If every one of those accounts is subject to the same Conditional Access policies, MFA requirements, and identity provider dependencies as normal users, a systemic outage can lock the organization out of its own development infrastructure entirely. Common failure modes include misconfigured Conditional Access policies, identity provider outages, and lost MFA devices.
Without a deliberate emergency access plan, recovery depends on vendor support tickets and escalation processes that may take hours or days while production pipelines sit idle.
Failing to plan for emergency access means a single identity-layer disruption can cascade into a complete loss of control over source code, secrets, and deployment infrastructure. Teams should be able to recover administrative control quickly enough to investigate incidents, restore service, and protect production delivery systems. Planning and regularly testing break-glass access is a direct expression of Assume breach, ensuring the organization can regain control even when its primary identity and Conditional Access paths fail or are compromised.