Emergency access (break-glass) accounts

Microsoft recommends two cloud-only Global Administrator accounts excluded from Conditional Access, so a bad policy, an expired federation certificate or an MFA outage cannot lock every administrator out of the tenant at once. This is a resilience control: without it, recovery from a lockout runs through Microsoft support and takes days.

A scan reports where your tenant stands on this check — pass, fail with a step-by-step fix, or not applicable if your licensing doesn’t include the feature. When Tenant Strike can’t read a setting with read-only access, it says unverified and gives you a one-command way to confirm it yourself — it never guesses.