I'm documenting the systems for a small nonprofit I've supported for years, and I may not be available much longer. The password manager is set up with multiple MFA options, including a hardware security key, but I realized that Microsoft 365, Duo Security, and similar services also need a reliable handoff plan. Microsoft Authenticator is currently enabled, but if I suddenly became unavailable, a new administrator might not be able to sign in or recover the accounts. Does Microsoft 365 support registering hardware security keys alongside authenticator apps, and can Duo use a similar setup? For small organizations, what's the safest way to provide backup MFA methods without relying on email?
3 Answers
A common approach is to create two separate emergency, or break-glass, administrator accounts. Give each a strong, unique password and its own hardware security key, then store the keys in separate secure locations. Keep one with IT and another in a sealed, clearly labeled envelope held by trusted management. Enable alerts and monitoring for any sign-in to these accounts, and test the recovery process periodically so the keys and credentials are actually usable when needed.
Authenticator backup codes or a protected copy of the enrollment information can be kept in a safe location, but treat them like highly sensitive credentials. Don’t leave them in ordinary email or an easily accessible document. Whatever method you choose, document who can retrieve it, how they sign in, and how the organization will rotate passwords and remove old administrators after the handoff.
Use at least two hardware keys in different physical locations, such as a secure office cabinet and an executive or management safe. Microsoft 365 can generally support multiple authentication methods, so a spare key can be registered in advance rather than relying on a phone that may be lost or unavailable. Keep the recovery details documented and restrict access to the people who would actually inherit the administrator responsibilities.
That also gives you protection if one key is lost or damaged. For services with stricter limits on hardware tokens, a second emergency administrator account may be needed instead of adding another key to the same account.
That’s close to what I’m planning. I’m going to add another hardware key and make sure the backup credentials are stored in the password manager under the appropriate emergency account.