​

Break the Glass (Emergency Access)

Break the Glass is an emergency access feature that allows designated administrators to bypass SSO enforcement and log in with their password. This ensures you’re never locked out of NeuralTrust if your identity provider experiences an outage.

​

When to Use It

• Your identity provider (IdP) is down or experiencing issues
• You need to access NeuralTrust during an SSO misconfiguration
• Emergency situations where SSO login is not working
• IT administrators need guaranteed access for incident response

---

​

Per-Provider Configuration

This means:

• If Microsoft Entra ID is down, users in its Break Glass list can log in with password
• If your OIDC provider is down, users in its Break Glass list can log in with password
• You should configure Break Glass users for each SSO provider you have enabled

---

​

How It Works

1. Team Owner/Admin adds email addresses to the Break-Glass Users list for each SSO provider
2. These users can log in with email + password even when “SSO Enforcement” is ON for that provider
3. All break-glass logins are recorded in Audit Logs for security tracking
4. Maximum 5 break-glass users per provider (recommended: 2-3)

​

Normal User vs Break-Glass User

---

​

Prerequisites

Before adding someone to the break-glass list, they must:

---

​

Configuring Break-Glass Users

​

Step 1: Open SSO Settings

1. Log in to NeuralTrust as Owner or Admin
2. Go to Settings → SSO
3. Select the SSO provider tab you want to configure:
   • Microsoft Entra ID tab
   • Generic OIDC tab

​

Step 2: Enable SSO Enforcement

1. In the selected provider tab, toggle Enforce SSO to ON
2. You’ll see a warning that password login will be disabled for non-break-glass users

​

Step 3: Add Break-Glass Users

1. The Break Glass Users section appears below the Enforce SSO toggle
2. Click Edit to enter editing mode
3. Enter the email address of a team administrator
4. Click Add — the system validates the user meets requirements:
   • ✓ User exists in the system
   • ✓ User has a password set
   • ✓ User is a member of this team
5. Repeat for additional users (recommended: 2-3)
6. Click Save

​

Step 4: Verify Configuration

1. You should see the email(s) listed as badges in the Break-Glass Users section
2. These users can now log in with password even with SSO enforced for this provider

​

Step 5: Repeat for Other Providers (If Applicable)

If you have multiple SSO providers configured:

1. Switch to the other provider tab
2. Repeat Steps 2-4 to configure Break Glass users for that provider

---

​

Validation Errors

---

​

How Break-Glass Login Works

​

For Normal Users (Not Break-Glass)

1. User goes to login page
2. Enters email
3. System detects SSO is enforced → redirects to “Sign in with Microsoft”
4. Cannot use password login

​

For Break-Glass Users

1. User goes to login page
2. Enters email
3. Enters password
4. System checks: Is this email in the break-glass list? ✓
5. System checks: Is user a team member? ✓
6. Login succeeds with password
7. Event logged in Audit Logs

---

​

Removing Break-Glass Access

​

Step 1: Open Break-Glass Settings

1. Go to Settings → SSO
2. Scroll to Break the Glass Users

​

Step 2: Remove User

1. Click the X or Remove button next to the email
2. Click Save Break-Glass Users
3. The user will now be required to use SSO like everyone else

---

​

Audit Logging

All break-glass activity is logged for compliance and security monitoring.

​

Events Logged

​

Viewing Break-Glass Events

1. Go to Settings → Audit Logs
2. Filter by Event Type: Login Success
3. Look for events with “Break-glass user logged in via password” in the description

---

​

Security Best Practices

---

​

FAQ

Q: What happens if my IdP is down and I’m not a break-glass user? You won’t be able to log in until the IdP is restored. This is why it’s important to configure break-glass users proactively. Q: Can break-glass users also use SSO? Yes. Break-glass users can choose either method — password OR SSO. The break-glass setting only enables password as an additional option. Q: Is there a way to know when break-glass was used? Yes. All break-glass logins appear in Audit Logs with a specific flag. You can filter for these events to monitor emergency access usage. Q: What if I remove all break-glass users and SSO goes down? You would be locked out. Always keep at least one break-glass user configured when SSO Enforcement is enabled. Q: Does break-glass work with any SSO provider? Yes. It works with Microsoft Entra ID, generic OIDC providers, and any future SSO integrations. The feature is provider-agnostic. Q: Can Members be break-glass users? Yes. Any team member with a password configured can be added to the break-glass list, regardless of their role (Owner, Admin, or Member).

---

​

Related Documentation

• Microsoft Entra ID SSO — Set up SSO with Microsoft
• Generic OIDC SSO — Set up SSO with Okta, Auth0, etc.
• Audit Logs — Monitor break-glass login events