How are you setting up alerts for break glass account sign-ins?

Azure Monitor is a solid choice. Send the Entra sign-in logs to a Log Analytics workspace, then create a log alert that matches the emergency accounts. Attach an action group with the email addresses of administrators who should respond.

Monitor audit activity for those accounts too, not just sign-ins. Check the workspace and alert pricing before setting it up, since there can be a recurring cost. Test the alert so you know the notification actually reaches the right people.

Defender custom detection is worth considering if you already have the right licensing and the relevant sign-in data available there. A KQL rule may be simpler to manage alongside your other detections. Check that the notification setup gets an email to the right people, rather than assuming the detection alone will do it.

I'd also look at the password manager. An alert when someone retrieves the emergency credentials gives you a separate signal from the actual sign-in alert. Whether you can do that depends on the password manager's audit and notification features.

The best route depends on what your tenant license includes and what other monitoring tools you already use. A third-party security monitoring tool might be an option if it can ingest the relevant Entra logs and send notifications. Check its capabilities and costs before adding another tool just for this.