Feature: Break Glass Account
A break glass account provides a secure, non-SSO fallback that ensures your users can always access Keeper, even if your identity provider, SSO flow or other authentication systems are unavailable.
A break glass account is a dedicated Keeper administrator account that is intentionally not tied to SSO, IdP integrations, directory sync or other external dependencies. This account is protected with a strong master password and MFA, allowing designated administrators to sign in directly to Keeper during emergency situations such as:
An administrator manually creates a separate Keeper account that is not enrolled in SSO and uses a strong master password with MFA enabled.
If SSO or infrastructure issues prevent standard admin login, authorised staff authenticate directly with the master password and MFA.
The break glass admin can access designated vault records, restore or modify SSO configurations, launch sessions via Keeper Connection Manager (if permitted) and perform administrative recovery or emergency operations.
All actions taken are logged, including vault actions, role or policy changes, secrets access and session launches
Administrators can authenticate directly with a master password and MFA, without relying on identity providers or directory sync.
With Keeper Secrets Manager and Keeper Connection Manager, credentials can be injected at launch so passwords are never revealed.
All use of the break glass account is logged and can include session recordings and RBAC-controlled permissions.
Keeper Connection Manager supports on-prem deployments to maintain access continuity.
Only a small number of trusted administrators should have access. Enforce MFA and strong master password through role-based enforcement policies.
Admins can sign in using the break glass account's master password and MFA, bypassing SSO.
Yes, Role-Based Access Controls (RBAC) define exactly what systems or records this account can access.
No, a break glass account is simply an admin user you create. Advanced capabilities (session launch, credential injection, session recording) require Keeper Connection Manager and Keeper Secrets Manager.
You must accept cookies to use Live Chat.