Break-glass accounts should be exempt from this check or at least configurable as exclusions. These accounts exist specifically for emergency access scenarios, and any automated blocking mechanism introduces an unnecessary risk of tenant lockout.

A security control should never be capable of disabling the very recovery mechanism designed to restore access when all other controls fail. Break-glass accounts should therefore be excluded from inactivity-based blocking or, at minimum, be protected by a configurable grace period. In the worst case, a missed review cycle, operational oversight, or unforeseen circumstances could result in administrators being locked out of their own tenant during a critical incident.