Emergency admin account

For tenant admins, emergency-operator, auditors.

Sometimes a device has to be administered when nothing else works: the network sign-in is broken, the domain trust is lost, or the device is offline in a server room. The emergency admin account is the break glass for those cases. It works like LAPS with one difference: the account is disabled except inside a usage window that you open from the portal. No user is ever a standing local administrator. Enterprise license.

How it works

1. You enable the account under Settings, Emergency admin account. The portal creates an escrow key for your tenant; its private key never leaves the key store.
2. Every device creates the local account (default name aex-emergency), makes it a member of Administrators, denies it Remote Desktop and network sign-in, and keeps it disabled.
3. The device generates a long random password, sets it, encrypts it with your tenant’s public key and sends only the encrypted password to the portal. The portal never stores a password in clear text.
4. When you need the account, you reveal the password on the device page. The portal decrypts it once, shows it to you once, and tells the device to enable the account for the usage window.
5. After the window, or 4 hours after the first sign-in with the account (whichever is earlier), the device disables the account again, changes the password and escrows the new one.

The password is also rotated on a schedule (every 30 days by default), even when nobody used it. A device that cannot reach the portal keeps the previous password until the new one is escrowed, so the escrowed password always works.

Settings

Setting	Default	Meaning
Enable	off	Turn the account on for every device of the tenant
Account name	aex-emergency	3 to 20 characters, no spaces; not Administrator, Guest or another built-in account
Usage window	4 hours	1 to 24 hours after a reveal
Rotate every	30 days	7 to 90 days
Allow partner administrators to reveal	off	When off, only tenant administrators and emergency operators of the tenant can reveal

Without an Enterprise license the devices keep the account disabled.

Who can reveal

• Tenant administrators and emergency operators of the tenant. The emergency operator role can see the devices and reveal, nothing else; give it to the people on call.
• Partner administrators only when the tenant allows partner reveal.
• Auditors and approvers cannot reveal.

Revealing a password

Open the device, find Emergency admin account and choose Reveal password.

• A fresh sign-in is required. Your Microsoft sign-in must be less than 10 minutes old. In a tenant without Microsoft Entra sign-in, any sign-in less than 10 minutes old counts. If yours is older, choose Sign in again and come back.
• A reason is required, for example the ticket number.
• The password is shown once. Copy it, use it, and close the dialog.
• The device enables the account at its next policy check (within about 15 minutes). If you can reach the device, Sync now in the tray applies it at once.
• Sign in at the device console with .\aex-emergency (or your account name) and the password. Remote Desktop and network sign-in are refused for this account by design.

Audit

Every step is recorded in the audit log with kind emergencyAccount: the reveal (who, when, why, which device), a failed reveal, the account being enabled, the first sign-in, disabled again, the password rotated and escrowed, conflicts, and escrow key rotations. Filter the audit page by the kind Emergency admin account to see them. The Emergency account page lists every device with its state, last rotation and the end of an open window, and exports CSV.

Conflicts

A device refuses to manage the account and reports a conflict when:

• Windows LAPS manages an account with the same name, or
• the chosen name is the built-in Administrator account.

Choose another account name (or stop managing that account with Windows LAPS). The device page shows the conflict.

Escrow key rotation

Under Settings you can rotate the tenant’s escrow key. The devices encrypt their password again with the new key at their next policy check. The old key is kept until every device has done so, so reveals keep working throughout.

Local administrator protection

The local administrator protection never removes the emergency account from Administrators. See Local administrator removal and protection.

Related guides

• Local administrator removal and protection
• Security model overview
• Audit and reports