> For the complete documentation index, see [llms.txt](https://docs.coherent.global/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.coherent.global/identity-and-access-management/break-glass-account.md).

# Break glass account

A break glass account is essential for maintaining access to Keycloak in emergencies when primary authentication methods fail, such as IdP downtime or SSO issues.

It typically has admin-level permissions and uses a local account username and password, ensuring access even if external IdPs are compromised, providing a crucial backup when normal authentication methods are unavailable.

## Add a break glass account in Keycloak

{% hint style="warning" %}
Do not enable MFA on this account to ensure quick access during emergencies. Secure it with strong, unique passwords, monitor for unauthorized access, and audit its usage regularly.
{% endhint %}

1. Sign in to the target Spark tenant. Access the **Keycloak console** from the [Navigation menu](/navigation/navigation-menu.md#user-menu).
2. Sign in to the **Keycloak Admin Console** using your admin credentials.
3. Select the **Users** section.
4. Select **Add user**.
5. Enter the username field and create the user.
6. Select the **Credentials** tab.
7. Set a strong, unique password.
8. Ensure **Temporary** is toggled off.
9. Select the **Groups** tab.
10. Select the **Join Group** button.
11. Select `tenant-admin` and click **Join**.