Check the tenant can still be recovered
Confirm that your tenant can still be entered when its identity provider cannot be reached: which members are designated for break-glass access, how many security keys or device-bound passkeys each holds, and when each last used break-glass sign-in.
Who can do it
Every built-in tenant role can read the readiness. The console shows it only to a person who holds both the permission to read break-glass readiness and the permission to read the tenant's authentication policy, which every built-in tenant role holds. Reading it changes nothing.
Before you start
- Members are designated for break-glass access on Team Members, by a tenant administrator. This task only reads the result.
- Only security keys and device-bound passkeys count. A synced passkey does not.
Steps
- Open Settings from your tenant's navigation and select the Access & policies tab.
- Under How members sign in, find the Break-glass access panel.
- Read the verdict, the minimum number of security keys or device-bound passkeys the deployment requires per designated member, and, for each designated member, the number they hold and their last break-glass sign-in.
What you see when it worked
When at least one active designated member holds the minimum, the panel reads Ready. Members can enter even when the identity provider is unreachable. Each member is marked Ready or Below the minimum. When a designated member holds a single key, the panel recommends Give each designated member a second security key: a single lost or broken key would leave that member unable to sign in.
While no designated member is ready, the panel says so, and the tenant cannot require sign-in through the identity provider only.
If it fails
| What you see | Cause | What to do |
|---|---|---|
| No member is designated. | Nobody in the tenant is designated for break-glass access | A tenant administrator designates a member on Team Members |
| A member reads Below the minimum | The member holds fewer qualifying security keys or device-bound passkeys than the deployment requires | The member enrols another security key or device-bound passkey |
| Break-glass readiness could not be read | The read failed | Select Retry |
| No Break-glass access panel | You lack the permission to read break-glass readiness or the authentication policy | Ask a tenant administrator for it |
Without the console
| Surface | How |
|---|---|
| API | GET /api/v3/admin/tenants/{tenantId}/break-glass (operation getTenantBreakGlassReadiness). preconditionSatisfied is true when at least one active designated member holds the minimum, and recommendation is ADD_SECOND_AUTHENTICATOR when a designated member holds fewer than two |
Related
- Tenant Settings: the sign-in requirements and the break-glass panel on the Access & policies tab.
- Team Members: designating a member for break-glass access.