Explore Cerby Emergency Access
This article describes Cerby Emergency Access and how it lets assigned users log in during an identity provider outage.
Cerby Emergency Access is an emergency login method that lets a small set of pre-assigned workspace members log in to Cerby with a registered security key, without going through your identity provider. It helps you keep control of your workspace during an identity provider outage or lockout, so an assigned user can respond to the incident instead of waiting for the identity provider to recover.
Workspace Owners and Super Admins assign and manage emergency access users. Any assigned user, except Guest Users and Login-Only users, can register a security key and log in with emergency access. Emergency Access is supported using the Cerby web app.
Key benefits
Emergency Access gives your workspace these key benefits:
Access during identity provider outages: Emergency Access lets an assigned user log in to Cerby even when your identity provider is completely unavailable, so an outage never fully locks your team out of the workspace.
Tightly scoped emergency access: A workspace can assign up to three emergency access users. Emergency Access grants only the assigned user's existing workspace role, so it does not introduce a new, broader privilege level.
Hardware-backed verification: An emergency access login requires a physical security key, so emergency access cannot be triggered with a password or a code alone.
Automatic session controls: An emergency access session expires after thirty minutes and cannot be extended. Workspace Owners and Super Admins can end an active emergency access session at any time.
Automatic revocation when a user is deprovisioned: When your identity provider deactivates or deletes an assigned user through your SCIM integration, Cerby automatically removes the user's registered security keys and emergency access assignment, and ends any active emergency access session, for both SCIM deactivation and deletion. If Cerby can't end an active session immediately, the security keys are still removed right away and the session expires automatically within thirty minutes.
Built-in audit visibility: Cerby emails your workspace Owners, Super Admins, and Admins every time an emergency access login is attempted, whether it succeeds or fails, so your security team always has real-time visibility into emergency access activity. Login alerts require no configuration and cannot be turned off.
Key features
Emergency Access includes the following capabilities:
Assignment and enrollment
Assigning a user and registering their security key involves the following:
Emergency Access assignment: Workspace Owners and Super Admins choose which users can use emergency access, up to three users per workspace. Only active users who log in through your identity provider are eligible; guest users cannot be assigned.
Security key registration: An assigned user registers up to five FIDO2 or WebAuthn security keys from a normal, identity-provider-authenticated session, before any outage occurs.
Emergency login
When your identity provider is unavailable, an emergency access login works as follows:
Identity-provider-independent login: An assigned user logs in with their email address and their registered security key, bypassing the identity provider entirely.
Time-limited sessions: Emergency access sessions last up to thirty minutes and cannot be refreshed. To continue working past that window, the assigned user logs in again with their security key.
Administration and oversight
Workspace Owners and Super Admins have the following tools for managing emergency access:
Session termination: Workspace Owners and Super Admins can immediately end an active emergency access session from the Emergency Access tab in Workspace Configuration.
Assignment removal: Removing an assignment immediately revokes the user's registered security keys and any active emergency access session.
Login alerts: Workspace Owners, Super Admins, and Admins receive an email every time an emergency access login is attempted, whether it succeeds or fails. The assigned user also receives a confirmation email when their emergency access login succeeds.
Supported platforms
Emergency Access is available on the following platform:
Cerby web app
How to get started
To get started with emergency access, you must complete the following steps:
As a workspace Owner or Super Admin, use the steps in Assign users to emergency access to assign up to three users.
As an assigned user, use the steps in Register a security key for emergency access to register a security key from the emailed invitation.
If your identity provider becomes unavailable, use the steps in Log in with emergency access.
TIP: Assign people from different parts of your team, and confirm each assigned user can complete an emergency access login before you need it during an actual outage. An emergency access user with no registered security key cannot be used in an emergency.
Related articles
Setup guides:
Troubleshooting:
Last updated
Was this helpful?