20 Break-glass admin + offline backup codesdraft

Caveats

• Backup codes are single-use and printed once¹
• A break-glass account with no alert on its use is just a second super admin
• Exempt it from the policies you enforce elsewhere (SSO №15, Context-Aware Access №14, ‘only security key’ №7)²

Setup steps

1. open ↗

   

   https://admin.google.com/ac/users · captured 2026-07-15

   Directory › Users ↗

   Create a dedicated super-admin account that is excluded from third-party SSO, so an IdP outage or compromise cannot lock you out of your own tenant.

   New user in its own OU; Security > Authentication > SSO profile = None for that OU

   Setting up SSO ↗

2. Set up alerting on any use of this account — see 2 Alert recipient hygiene + suspicious-login alerts and 61 Audit-the-auditors alerting. An unused break-glass account that logs in is either you or an incident.

   Activity rule on login events for this account (Rules, or Reporting > Audit and investigation > Create activity rule); alerts surface in the Alert Center

   Create and manage activity rules ↗

3. Generate and print the single-use backup codes, then store the printout sealed offline. Reprinting invalidates the old set — reseal and re-log custody every time.

   Directory > Users > select the user > Security > 2-step verification > Get backup verification codes; sealed envelope, tamper-evident, split custody

   Recover an account protected by 2-Step Verification ↗

Ongoing maintenance

• requires a human Quarterly: repeat the sign-in drill and re-seal fresh backup codes; log the drill.

How to verify

1. Sign in with the break-glass account using a stored backup code from a clean browser. Re-seal fresh codes afterwards.

2. Confirm it holds super admin and is excluded from SSO (№15) and CAA (№14) enforcement.

   gam print admins | grep <breakglass-address>