Emergency Break-glass process for Azure

It is a procedure that is used as a last resort to get access to key systems or data when conventional access methods are unavailable. This approach is known as a break-glass process. Within the framework of Azure, a break-glass process is often characterized by the utilization of privileged credentials for the purpose of gaining access to and managing Azure resources in the event of an emergency.

This design document provides an overview of the break-glass process for Azure, including its objectives, requirements, and responsibilities, as well as the methods involved.

The goal of the break-glass process is to establish a regulated and traceable method for obtaining access to Azure resources in the event of a severe incident that hinders regular access. Examples of such situations could encompass:

Key Considerations:

The break-glass method is applicable to all Azure resources, encompassing resource groups, subscriptions, virtual machines, storage accounts, and network resources etc., etc., Its purpose is to explicitly grant access to privileged administrative duties that are usually limited to a select few individuals.

The break-glass process entails the following established roles and responsibilities:

Use Cases:

Initially, it is essential to establish the specific use cases in which the break-glass procedure will be employed. These use cases may encompass:

1. Unintentional Account Lockouts: After a certain number of failed login attempts have been reached. The purpose of this account lockout feature is to prevent automated digital attacks that include multiple brute-force login attempts.


2. Conditions Access Policies that Aren’t Set Up Properly: The Break Glass account can circumvent conditional access settings and rectify setup errors, even if they block admin access.


3. Possible compromise of primary administrative accounts: The Break Glass account can be used to safeguard the environment and conduct incident response steps if there is a suspicion that all accounts or critical administrative accounts have been hacked.


4. Problem with Multi-Factor Authentication: The Break Glass account can be utilized in situations where the MFA service is unavailable, preventing administrators from authenticating and managing resources.


5. AD to AAD account synchronization issue: In hybrid scenarios where on-premises directories synchronize with Azure AD, any malfunction or misconfiguration can block admin access. The Break Glass account, being cloud-only, remains unaffected and can be used to rectify the issue.


6. Connectivity down due to a natural disaster: The Break Glass account can be utilized by a secondary team or location to guarantee business continuity in the event that the IT team is disabled or unable to access their accounts, such as in the case of a natural disaster.


7. Azure Service lockout: If you ever experience problems like service lockouts caused by unpaid subscriptions, you can utilize the Break Glass account to get back in and fix the underlying cause.


8. Authentication Authorization Protocol Issues: If you ever experience like protocol issues caused AA failure, you can utilize the Break Glass account to get back in and fix the underlying cause.


9. External IDP redirection Issues: If you ever using external IDP for authentication and authorization for Azure and Azure applications, you can utilize the Break Glass account for emergency login

Monitor break-glass account activity:

Keep an eye on what’s happening with break glass accounts to make sure they’re being utilized for what they should be. Configure Azure to send logs from Azure AD to an Azure log Analytics Workspace where a sentinel watches over audit and sign-in logs. Break Glass accounts can be monitored with this solution effectively.

How to implement?

Hiring a professional with a background in security practices (CISSP, CCSP, or equivalent) and an Azure certified architect is a smart move.

In Summary

Organizations must incorporate a clearly defined break-glass procedure into their Azure security policy. It reduces the likelihood of illegal access or abuse of privileged credentials and provides a regulated and auditable way to access vital resources during an emergency. Businesses may make sure their break-glass approach is secure and successful by following the steps and rules laid out in this design document.