What is a Service Account/Break glass account

A break-glass account (Service Account) is an emergency admin account that uses local Keeper authentication (Master Password) instead of SSO/SAML. (More details here)

It serves as a failsafe if your authentication system is unavailable. Without a break-glass account, an SSO outage could result in complete Keeper lockout for your organization.

Common scenarios that require Break-Glass access:

1. Identity provider (Okta/Azure/Ping) goes down
2. SAML certificate expires
3. Someone breaks the SSO configuration
4. All admins accidentally get de-provisioned via SCIM
5. Network issues prevent authentication

To set up a break-glass account, follow these steps:

1. Log in to the Admin Console.
2. Select the Admin tab in the left-hand panel.
3. Go to Users.
4. Click Add User (to the root node).
5. Set a strong Master Password and securely store it (e.g., in a physical safe or separate secure system).
6. Assign the user to the Keeper Administrator role.
7. Test the login immediately to confirm access.

Please note that it is best practice to create two break-glass accounts and test them quarterly to ensure the Master Passwords are not lost or forgotten.

Be sure to document who is authorized to use these accounts.