19 Break-glass admin + offline backup codes

draft

A separate admin account, used only in an emergency, whose credential and printed single-use backup codes are held offline. Its username is an unguessable random string, and it lives in a dedicated OU kept out of any third-party SSO profile and exempted from all Context-Aware Access restrictions, so an IdP outage, a CAA lockout or a compromise cannot lock you out of your own tenant. Every sign-in to it is alerted on — an account that is never used has no legitimate login. It is the recovery path for every other control here that can lock you out.

Documentation: Security best practices for administrator accounts

Caveats

A break-glass account with no alert on its use is just a second super admin.
Exempt it from the policies you enforce elsewhere (SSO №22, Context-Aware Access №14, ‘only security key’ №7) — the account exists precisely for the day one of those is what broke.

Setup steps

Create a dedicated super-admin account with an obfuscated username — a random string, not breakglass@ or admin@ — so it cannot be guessed or targeted by name. Place it in its own OU, excluded from third-party SSO and exempted from every Context-Aware Access level, so an IdP outage, a CAA misconfiguration or a compromise cannot lock you out of your own tenant.

open ↗

https://admin.google.com/ac/users · captured 2026-07-15

Directory › Users

New user (random-string username) in a dedicated OU; Security > Authentication > SSO profile = None for that OU; no CAA access levels assigned to that OU (№14)
Set up alerting on any use of this account — see 2 Alert recipient hygiene + suspicious-login alerts and 63 Audit-the-auditors alerting. An unused break-glass account that logs in is either you or an incident.

Activity rule on login events for this account (Rules, or Reporting > Audit and investigation > Create activity rule); alerts surface in the Alert Center

Create and manage activity rules
Generate and print the single-use backup codes, then store the printout sealed offline. Reprinting invalidates the old set — reseal and re-log custody every time.

Directory > Users > select the user > Security > 2-step verification > Get backup verification codes; sealed envelope, tamper-evident, split custody

Recover an account protected by 2-Step Verification

Ongoing maintenance

requires a human Quarterly: repeat the sign-in drill and re-seal fresh backup codes; log the drill.

How to verify

Sign in with the break-glass account using a stored backup code from a clean browser. Re-seal fresh codes afterwards.
Confirm it holds super admin and is excluded from SSO (№22) and CAA (№14) enforcement.
```
gam print admins | grep <breakglass-address>
```

draft v0.2.0 Recover policy #3 · #11 ↗