Every recovery plan quietly assumes one thing: that you can sign in. The runbook assumes admin access; the backup restore assumes someone can reach the console; the incident response assumes IT can disable the attacker’s accounts. Now run the scenario where identity itself is the casualty — the Microsoft 365 tenant’s admin accounts compromised or locked, the attacker who got in first changing the locks on you, or the mundane version: the only global admin’s phone (and its MFA app) at the bottom of a lake. Identity is the system every other system authenticates against, which makes it the single point of failure hiding inside every plan. The fix is a short list of preparations, all cheap, all awkward to improvise later. Here it is.
The break-glass account: the one door that never changes
The centerpiece is enterprise practice scaled down: one or two emergency-access (“break-glass”) accounts with global admin rights, built to survive the failure modes that lock everyone else out. The recipe: a cloud-only account (not synced from any local directory, so a directory problem can’t take it down) · a very long random password stored offline — the sealed envelope in the fire safe, the emergency section of the password manager with a second custodian — split between two people if you want ceremony · excluded from Conditional Access policies (the very policies that could misfire and lock everyone out — a real and embarrassingly common scenario), with MFA via a hardware key kept with the envelope rather than an app on someone’s phone · never used for anything else, and alerted on so that any sign-in to it — legitimate or not — pages a human immediately. An account that’s touched twice a year in tests and screams when touched otherwise is exactly the design.
The MFA recovery paradox, solved on a calm day
MFA’s whole point is that possession matters — which creates the recovery paradox: the phone that proves who you are is a device that gets lost, dies, and resets. Multiply by every employee and the questions arrive weekly; the plan is three decisions written down: a verified reset process — who can reset a user’s MFA, and how they verify identity first (a video call, a manager confirmation, an in-person visit — decided in advance, because the attacker who phones the help desk pretending to be a locked-out executive is a known play, and the reset process is itself an attack surface) · second factors registered per user where practical, so one lost phone isn’t a lockout · and hardware keys or printed one-time codes for the accounts that can’t afford downtime — admins above all.
The dependencies under the identity system
Identity has its own quiet dependencies worth mapping once: the domain — DNS control can redirect authentication flows, so registrar security is identity security · the recovery contacts on the tenant itself — Microsoft’s own account-recovery paths run through phone numbers and emails that must not belong to departed employees; verify them annually · synchronization, if you run hybrid — know which direction is authoritative and what breaks when the sync server dies · and the vendor path: if all else fails, tenant recovery through Microsoft support is possible but slow and proof-heavy — the business registration documents, domain ownership evidence, and payment records that establish “we are really us” belong in the same fire safe as everything else, because gathering them mid-crisis is the slow version.
The compromise scenario: eviction, not just recovery
When identity is taken rather than lost, recovery has an extra phase: eviction. Regaining a foothold via the break-glass account is step one; steps two through five assume the attacker prepared to persist — so the sweep covers every credential and session (global revocation, password resets in privilege order), every mail rule and delegate, every app consent (the attacker’s favorite durable backdoor), every MFA registration (attackers add their own devices to victim accounts — review recent registrations specifically), and every admin role assignment against a known-good list. This is precise, ordered work best done with professional response — and it’s the scenario where the audit logs you retained determine whether eviction is surgical or archaeological.
The bottom line
Identity is the recovery plan’s recovery plan: a break-glass account built to survive what locks everyone else out, MFA resets governed by verification instead of improvisation, the tenant’s own recovery paths kept current, and an eviction checklist for the day the locks were changed by someone else. Two hours of preparation, tested twice a year — against the one failure mode where every other plan’s first step is impossible.