Could Your Business Recover Its Admin Accounts?

If the person who manages your business email loses their phone, can someone else restore access? That is a useful question for a South Orange County office to answer before holiday schedules and staff absences make the usual contact harder to reach.

A written password list does not prove the recovery route works. The account may require a device nobody else can access, an approval from the unavailable person, or an email address inside the system that is locked. Run a controlled access drill and record what actually succeeds.

Draw the recovery chain

Start with business email, the domain registrar, DNS hosting and the password manager. These may be separate services even when one vendor sends the bill. For each, record the responsible administrator, the backup decision-maker and the approved recovery method. Record where credentials are secured, not the credentials themselves, in the exercise notes.

Look for loops. If your password manager requires business email to recover, and business email requires a password stored only in that manager, the written plan has no independent starting point. Ask your IT provider to resolve that dependency before testing a lockout scenario.

Use the platform’s recovery design

Microsoft’s emergency access guidance calls for at least two cloud-only emergency accounts, protected with phishing-resistant authentication, with monitored use and regular validation. It also addresses policy exclusions so emergency access does not depend on the same controls that caused the lockout. Have the administrator configure this from the full guidance; an unprotected shared account is not a substitute.

For Google Workspace, Google’s administrator guidance covers separate identifiable admin accounts, recovery options, spare security keys and securely stored backup codes. It also explains that some recovery paths require proof of domain ownership through DNS. Confirm the actual recovery settings for your organization rather than assuming a phone number guarantees recovery.

The approaches are not identical. Ask the provider to document which method applies to your platform and who may use it.

Test access without locking out the office

Schedule the exercise with the owner and administrator. Keep the normal administrator signed in and available. Do not delete accounts, revoke working methods, turn off MFA or change live DNS records to make the test feel realistic.

Use an approved, secure device and a separate browser session. Have the authorized backup person follow the documented route. Confirm that the intended account can sign in and reach the administrative area it is meant to control. For a platform-specific recovery workflow, follow the provider’s supported test procedure and stop before any action that would disrupt existing access.

Verify the domain administrator can reach the DNS management area without making a change. If account recovery would require a record update, establish who has permission to perform it and where the instructions are stored. That is a readiness check, not proof that a future support-assisted recovery will be immediate.

Check the alert and the handoff

An emergency sign-in should be noticed by the people responsible for the system. Check whether the intended alert arrived and whether someone knew what to do with it. Avoid making all notifications depend on the account being recovered.

When a test uses a single-use recovery item, follow the platform’s instructions to replace it and store the replacement securely. Sign out of the emergency session when finished. Record any maintenance needed without putting recovery codes into a ticket or ordinary email thread.

Keep a short evidence record

• System and purpose: what access the exercise was meant to verify.
• Authorized participants: who approved the test and who performed it.
• Result: successful sign-in, permission checked and notification received, recorded separately.
• Dependency found: inaccessible key, unavailable recovery address, missing DNS access or another specific obstacle.
• Correction: named owner, due date and date of the next test.

Repeat the review after changes to administrators, devices or service providers. Microsoft also recommends validating emergency accounts at least every 90 days in its linked guidance. Your routine should reflect the systems you actually use.

The staff onboarding and offboarding checklist covers the related access changes when people join or leave. Coastal Growth Co. can help scope an account-access review through its cloud and email services. The useful outcome is a tested recovery route and a clear owner for each remaining gap.