> For the complete documentation index, see [llms.txt](https://help.cerby.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.cerby.com/setup-and-admin/security-governance/emergency-access/explore-emergency-access.md).

# Explore Cerby Emergency Access

This article describes Cerby Emergency Access and how it lets assigned users log in during an identity provider outage.

Cerby Emergency Access is an emergency login method that lets a small set of pre-assigned workspace members log in to Cerby with a registered security key, without going through your identity provider. It helps you keep control of your workspace during an identity provider outage or lockout, so an assigned user can respond to the incident instead of waiting for the identity provider to recover.

Workspace **Owners** and **Super Admins** assign and manage emergency access users. Any assigned user, except **Guest Users** and **Login-Only** users, can register a security key and log in with emergency access. Emergency Access is supported using the Cerby web app.

## Key benefits

Emergency Access gives your workspace these key benefits:

* **Access during identity provider outages**: Emergency Access lets an assigned user log in to Cerby even when your identity provider is completely unavailable, so an outage never fully locks your team out of the workspace.
* **Tightly scoped emergency access**: A workspace can assign up to three emergency access users. Emergency Access grants only the assigned user's existing workspace role, so it does not introduce a new, broader privilege level.
* **Hardware-backed verification**: An emergency access login requires a physical security key, so emergency access cannot be triggered with a password or a code alone.
* **Automatic session controls**: An emergency access session expires after thirty minutes and cannot be extended. Workspace **Owners** and **Super Admins** can end an active emergency access session at any time.
* **Automatic revocation when a user is deprovisioned**: When your identity provider deactivates or deletes an assigned user through your SCIM integration, Cerby automatically removes the user's registered security keys and emergency access assignment, and ends any active emergency access session, for both SCIM deactivation and deletion. If Cerby can't end an active session immediately, the security keys are still removed right away and the session expires automatically within thirty minutes.
* **Built-in audit visibility**: Cerby emails your workspace **Owners**, **Super Admins**, and **Admins** every time an emergency access login is attempted, whether it succeeds or fails, so your security team always has real-time visibility into emergency access activity. Login alerts require no configuration and cannot be turned off.

## Key features

Emergency Access includes the following capabilities:

### Assignment and enrollment

Assigning a user and registering their security key involves the following:

* **Emergency Access assignment**: Workspace **Owners** and **Super Admins** choose which users can use emergency access, up to three users per workspace. Only active users who log in through your identity provider are eligible; guest users cannot be assigned.
* **Security key registration**: An assigned user registers up to five FIDO2 or WebAuthn security keys from a normal, identity-provider-authenticated session, before any outage occurs.

### Emergency login

When your identity provider is unavailable, an emergency access login works as follows:

* **Identity-provider-independent login**: An assigned user logs in with their email address and their registered security key, bypassing the identity provider entirely.
* **Time-limited sessions**: Emergency access sessions last up to thirty minutes and cannot be refreshed. To continue working past that window, the assigned user logs in again with their security key.

### Administration and oversight

Workspace **Owners** and **Super Admins** have the following tools for managing emergency access:

* **Session termination**: Workspace **Owners** and **Super Admins** can immediately end an active emergency access session from the **Emergency Access** tab in **Workspace Configuration**.
* **Assignment removal**: Removing an assignment immediately revokes the user's registered security keys and any active emergency access session.
* **Login alerts**: Workspace **Owners**, **Super Admins**, and **Admins** receive an email every time an emergency access login is attempted, whether it succeeds or fails. The assigned user also receives a confirmation email when their emergency access login succeeds.

{% hint style="info" %}
An emergency access session cannot be used to assign, enroll, or remove emergency access. These actions always require a normal, identity-provider-authenticated session.
{% endhint %}

## Supported platforms

Emergency Access is available on the following platform:

* **Cerby web app**

## How to get started

To get started with emergency access, you must complete the following steps:

1. As a workspace **Owner** or **Super Admin**, use the steps in [Assign users to emergency access](/setup-and-admin/security-governance/emergency-access/assign-users-to-emergency-access.md) to assign up to three users.
2. As an assigned user, use the steps in [Register a security key for emergency access](/setup-and-admin/security-governance/emergency-access/register-a-security-key-for-emergency-access.md) to register a security key from the emailed invitation.
3. If your identity provider becomes unavailable, use the steps in [Log in with emergency access](/setup-and-admin/security-governance/emergency-access/log-in-with-emergency-access.md).

{% hint style="success" %}
**TIP:** Assign people from different parts of your team, and confirm each assigned user can complete an emergency access login before you need it during an actual outage. An emergency access user with no registered security key cannot be used in an emergency.
{% endhint %}

## Related articles

**Setup guides:**

* [Assign users to emergency access](/setup-and-admin/security-governance/emergency-access/assign-users-to-emergency-access.md)
* [Register a security key for emergency access](/setup-and-admin/security-governance/emergency-access/register-a-security-key-for-emergency-access.md)
* [Terminate emergency access sessions](/setup-and-admin/security-governance/emergency-access/terminate-emergency-access-sessions.md)
* [Remove users' emergency access assignments](/setup-and-admin/security-governance/emergency-access/remove-users-emergency-access-assignments.md)
* [Log in with emergency access](/setup-and-admin/security-governance/emergency-access/log-in-with-emergency-access.md)

**Troubleshooting:**

* [Troubleshooting: Emergency Access issues](https://help.cerby.com/tips-and-troubleshooting/troubleshooting/workspace-access/troubleshooting-emergency-access-issues)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.cerby.com/setup-and-admin/security-governance/emergency-access/explore-emergency-access.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.