Agent WranglersIdentity and access Required
Keep tested break-glass accounts
Keep two emergency admin accounts that work when single sign-on is down. Store their factors offline, alert on every use, and test them twice a year.
How to do it
An outage at the identity provider must not lock you out of production. Create two emergency users with long random passwords and hardware keys, kept in a safe or a sealed vault entry. Exclude them from automatic rules that could disable them. Every use pages the team and opens an incident. After each use or test, change the password.
Example
Break-glass test, every March and September:
1. Two people open the sealed entry together.
2. Sign in to the sandbox account and list the users.
3. Confirm the page arrived, then sign out.
4. Set a new password, seal it, and log the date.How to check
The last test sign-in is less than 6 months old and raised the alert. Both accounts have hardware keys registered.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/identity-and-access/break-glass-access.