Azure AD: How to contact MS support in event of a severe disaster.

Question

With a customer, I'm working on his disaster recovery plan.

He has an on-premise Active Directory infrastructure with e-mails on Office365 and "Pass-through Authentication". In future, is possibile he choose to get additional resource on cloud like storage for remote backups or so on.
I read a document from Microsoft some months ago (I don't have it on hands now, but I'll try to search it) which suggested to enable also the "password hash synchronization" as a fallback method for authentication. In fact, in event of a severe incidents which occurs on on-premise infrastructure which lead it offline (or, anyway, out from internet) for a while, customer's users will neither be able to use their resources on cloud because the "Pass-through Authentication" relays on on-prem servers to authenticate cloud logins.
Switching from "Pass-through Authentication" to "Password Hash Synchronization" when on-premise resources are offline is not automatic but the document states that Microsoft support operators are able to modify the tenant configuration to switch between this authentication modes if requested to do it.

Well, my questions are:

• How can we open a support request on Microsoft Azure team if we can't authenticate con Azure Portal (due to the on-premise infrastructure failure)?
• Perhaps, I can login in the Azure portal with my own business account (I work for a different society) and open a ticket on behalf my customer but how can Microsoft support guys identify me as an authorized person to request this change if I've been logged in with the account of a different society?

I opened a support request on Azure support portal to clarify those matters (to add the full procedure on the disaster recovery plan) but the operator says that this is out of his competence and routed me to Global Support call center. I called the phone support where a recorded voice sent me on the site https://support.microsoft.com/oas which re-route me back to Azure again for each questions related to Azure.

Ok, this is a hypothetical very rare and extreme situations but I can't belive to be the first person to pose this question.

Any suggestions?

Answer 1

@Matteo Fracassetti Thanks for reaching out.

The support can help if the customer is premier because we have a way of confirming the customer via the account manager. If the customer is not premier, they would need to help us identify themselves. For this scenario they can have a break glass account created. (https://learn.microsoft.com/en-us/azure/active-directory/roles/security-emergency-access)

Using those break glass accounts they can contact support to verify their tenant.

Manually they can convert the authentication method to password sync themselves if the sync server is up and running as per this article
The article is for ADFS but the steps are same.

-------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hi, many thanks for your answer.

"Breaking glass account" seems the information I needed.