Break-glass sign-in
Local administrator account
This account exists for when Microsoft sign-in cannot be used — before the app registration exists, or during a tenant outage. Everyday access goes through Microsoft sign-in. Every attempt here, successful or not, is recorded with its time and address.
Repeated failures are throttled, then locked out. Recovering a forgotten password needs a shell on the server, not a reset email — there is no address to send one to.
