Designate a break-glass user

Make a member one of your tenant's emergency accounts, the way into your tenant when its identity provider cannot be reached, or clear that designation.

Who can do it

A tenant administrator. The console shows Break-glass identity to a person who holds the permission to read your tenant's break-glass access, and offers the change only to a person who holds the permission to manage it.

You must have confirmed your identity recently, and you can only designate someone whose permissions in your tenant you cover. A designation cannot be changed from a session signed in through emergency access, nor from a support-access session.

Before you start

Use a dedicated account. A member linked to an identity provider, restricted to it, or belonging to another organization is refused.
The member needs a security key or a device-bound passkey. A designated member signs in only through Emergency access on the sign-in page, with one of those; a password, an authenticator app, a recovery code, a synced passkey and a federated sign-in never enter their membership.
To clear a designation, have a reason ready. It is required and recorded in the audit trail.

Steps

Open Users in the sidebar.
On the person's row, select the eye icon (View).
On the Overview tab, find Break-glass identity. It reads Designated or Not designated.
Select Designate as break-glass. The change is sent at once.
To undo it, select Clear the designation and type the reason under Why is this designation being cleared?. Confirm with Clear the designation.
If the console asks you to confirm your identity, sign in again in the dialog it opens.

What you see when it worked

The console says Break-glass designation updated, and Break-glass identity reads the new state. Each sign-in of a designated member raises a security alert in your tenant, and their session is marked as a break-glass session.

If it fails

The console shows The designation could not be changed, with the reason:

Reason	Cause	What to do
The member cannot be a break-glass identity (`break-glass-designation-ineligible`)	The member is linked to an identity provider, restricted to it, or belongs to another organization	Designate a dedicated account
A conflict on clearing	It is the last designation that keeps a tenant that signs in through its identity provider only reachable	Designate another member first, or change your tenant's sign-in requirements
A refusal from an emergency-access session (`break-glass-session-cannot-change-designation`)	You signed in through break-glass	Sign in normally to change a designation
A refusal naming the permissions you lack (`scope-subset-violation`)	The member holds permissions in your tenant that you do not	Ask an administrator who holds those permissions
A request to confirm your identity (`reauthentication-required`)	Your last sign-in is too old for this change	Sign in again when asked, then retry

Without the console

Surface	How
API	`PUT /api/v3/admin/tenants/{tenantId}/users/{userId}/break-glass-designation` (operation `replaceTenantUserBreakGlassDesignation`) with `designated` `true`, or `false` and a `reason`

The key management CLI and the admin SDK have no command or method for this task.

Team Members: what the screen shows and every decision you make on it.
Break-Glass Designation Ineligible: which members cannot be designated.
Break-Glass Session Cannot Change Designation: the refusal from an emergency-access session.