> ## Documentation Index
> Fetch the complete documentation index at: https://neuraltrust-92b43583-develop.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Break the Glass

> Configure up to five emergency Break the Glass accounts in User & Roles. A single-organization account signs in with password only.

# Break the Glass (Emergency Access)

**Break the Glass** accounts are emergency administrators you create in
**[User & Roles](/platform/users)**. They have the same permissions as **Global
Admin**, use a **password** (minimum 30 characters, no MFA), and exist so you
are not locked out when SSO or your identity provider fails.

Normal users are **passwordless** (magic link or SSO only). You may create up to
**five** Break the Glass accounts per organization (recommended **2–3**).

<Warning>
  Always keep at least one Break the Glass account when **Enforce SSO** is
  enabled. Otherwise an IdP outage can lock out your entire organization.
</Warning>

***

## When to Use It

* Your identity provider (IdP) is down or experiencing issues
* You need to access NeuralTrust during an SSO misconfiguration
* Emergency situations where SSO login is not working
* IT administrators need guaranteed access for incident response

***

## Organization membership

Treat Break the Glass as an **emergency-only** account, and assign it to
**exactly one organization**.

| Membership                         | Sign-in behavior                                                                                                         |
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| **One organization (required)**    | **Password only** — always. Skips SSO and magic link.                                                                    |
| **Multiple organizations (avoid)** | Still **password only** for Break the Glass (skips SSO and magic link). Prefer a dedicated single-org emergency account. |

Normal (non–Break the Glass) multi-org users may see a magic link first so membership
is not disclosed before the email is verified — that path does **not** apply to Break
the Glass.

***

## How It Works

1. An Owner or Admin creates a Break the Glass account in
   **Platform settings → User & Roles** (password ≥ 30 characters).
2. Break the Glass authenticates with **password only** — it does not use SSO or
   magic link (single- or multi-organization).
3. When **Enforce SSO** is on, members on a **verified** email domain use the
   configured IdP. External-domain guests still use magic link (see
   [SSO](/platform/sso#part-5-enable-sso-only-mode-optional)). The Break the Glass
   account still uses password.
4. Maximum **five** Break the Glass accounts per organization (recommended: 2–3).
5. All Break the Glass logins are recorded in Audit Logs.

### Normal user vs Break the Glass

| Scenario           | Normal user                                                            | Break the Glass                              |
| ------------------ | ---------------------------------------------------------------------- | -------------------------------------------- |
| Sign-in            | Magic link or SSO (passwordless)                                       | **Password only** (skips SSO and magic link) |
| SSO Enforcement ON | Verified-domain members use IdP; external-domain guests use magic link | **Password only**                            |
| IdP is down        | Cannot use SSO                                                         | Can log in with password                     |

***

## Hardening (recommended)

* Keep **2–3** accounts (max **5** per organization) — not everyone.
* Rotate BtG passwords periodically; store them in your secret manager.
* Treat every BtG sign-in as an incident (audit alerts fire for organization admins).
* Disable or remove BtG access when the emergency is over.

***

## Creating a Break the Glass Account

1. Log in to <a href="https://app.neuraltrust.ai" target="_blank">NeuralTrust</a> as Owner or Admin.
2. Open **Platform settings → User & Roles**.
3. Invite a user or edit a member and apply the **Break the glass** role
   template (or mark the user as Break the Glass). The console provisions a long
   password (≥ 30 characters) — store it in your secret manager.
4. Confirm the account belongs to **only this** organization when possible.
5. Configure your **Email Domain**, then enable **Enforce SSO** when ready —
   see [Microsoft Entra ID SSO](/platform/sso) or
   [Generic OIDC SSO](/platform/generic-oidc-sso).

***

## Validation Errors

| Error                                  | Cause                                                  | Solution                                                                   |
| -------------------------------------- | ------------------------------------------------------ | -------------------------------------------------------------------------- |
| Password too short                     | Below the 30-character minimum                         | Set a longer password                                                      |
| Cannot use password sign-in            | User is not Break the Glass                            | Promote the user in [User & Roles](/platform/users)                        |
| Magic link required / org picker shown | Account is not Break the Glass (or not marked as such) | Confirm the Break the glass role is applied; BtG itself uses password only |
| Maximum accounts reached               | Already have five Break the Glass accounts             | Remove or demote an existing account first                                 |

***

## Removing Break the Glass Access

1. Go to **User & Roles**.
2. Edit the user and remove the Break the Glass role (or delete the account).
3. The user then follows normal passwordless sign-in (magic link or SSO).

***

## Audit Logging

All break-glass activity is logged for compliance and security monitoring.

| Event                | Description                                                                            |
| -------------------- | -------------------------------------------------------------------------------------- |
| `auth.login.success` | Break-glass user logged in successfully (metadata includes `isBreakGlassAccess: true`) |
| `auth.login.failure` | Break-glass login attempt failed                                                       |

### Viewing Break-Glass Events

1. Open **Audit Logs** in the console (location is moving; look under Telemetry / Logs when available).
2. Filter by Event Type: **Login Success**.
3. Look for break-glass sign-in events in the description.

***

## Security Best Practices

| Recommendation                             | Why                                         |
| ------------------------------------------ | ------------------------------------------- |
| Add 2–3 users (max **5** per organization) | Redundancy in case one is unavailable       |
| Use owner/admin–capable accounts           | They have permissions to fix SSO issues     |
| Use strong passwords (≥ 30 characters)     | Break-glass accounts are high-value targets |
| One organization per account               | Keeps the password-only sign-in path        |
| Test quarterly                             | Ensure break-glass users remember passwords |
| Document the process                       | Include in your incident response runbook   |
| Monitor audit logs                         | Review break-glass usage regularly          |

***

## FAQ

**Q: What happens if my IdP is down and I'm not a Break the Glass user?**

You won't be able to log in until the IdP is restored. Configure Break the Glass
accounts proactively before enabling Enforce SSO.

**Q: Can a Break the Glass account also use SSO or magic link?**

No. Break the Glass always signs in with **password only** — it skips SSO and
magic link, including if the account belongs to several organizations.

**Q: What if a normal (non–Break the Glass) account belongs to several organizations?**

That user receives a **magic link** before any organizations are shown, then picks
an organization (and may continue with that org's IdP if SSO is enforced). Prefer
a dedicated single-org Break the Glass account for emergencies.

**Q: Is there a way to know when Break the Glass was used?**

Yes. All Break the Glass logins appear in Audit Logs with a specific flag.

**Q: What if I have no Break the Glass account and SSO goes down?**

You would be locked out. Always keep at least one Break the Glass account when
Enforce SSO is enabled.

**Q: Where do I create Break the Glass accounts?**

**Platform settings → User & Roles**.

**Q: Can Members be Break the Glass users?**

Yes — apply the Break the Glass role in [User & Roles](/platform/users). Accounts
without that role are passwordless.

***

## Related Documentation

* [User & Roles](/platform/users) — create Break the Glass accounts
* [Microsoft Entra ID SSO](/platform/sso) — Enforce SSO
* [Generic OIDC SSO](/platform/generic-oidc-sso) — Enforce SSO
* [Audit Logs](/platform/audit-logs) — monitor Break the Glass login events