Set up break-glass

Setting up break-glass means connecting the brokers you use, designing least-privilege emergency roles from what they show, and setting the policy for arming and approval.

Connect your brokers

Break-glass is pluggable — it works with whichever access broker you use, not only one:

• Tenable — connect with an API key; break-glass reads JIT/CIEM entitlements and probes health.
• Microsoft Entra PIM — connect a read-only app registration (tenant, client ID and secret); break-glass reads eligible-role assignments from Microsoft Graph and treats the ability to reach Entra as the health signal.
• Any other broker — a generic HTTP health connector covers brokers without a tailored connector; tell us which broker you use and we will add a first-class connector.

Add each under Admin → Settings; their health shows at the top of Security → Break-glass. Each connection has its own health check and its own failures-to-arm threshold.

Each connector makes a live call and maps the result into a broker-agnostic model. Confirm a new connection with a credentialed test before you rely on it in production.

Map entitlements

Break-glass reads each broker’s current entitlements — who is eligible for which roles, over which scope — to design and attest emergency roles. It does not live-replicate these at activation time; the snapshot is used up front to map the least-privilege role each responder genuinely needs.

Design emergency roles

For each cloud (AWS, Azure, GCP) create a pre-provisioned, least-privilege emergency role scoped to what an incident actually requires. These are standing but attested, and designed from the mapped entitlements rather than copied wholesale.

Set the policy

Configure the activation policy: the activation TTL, the four-eyes approval requirement, the auto-approve-of-last-resort rule, and which broker health states arm the system.