NORTH STAR | EMERGENCY ACCESS DRILL RECORD
Version 1, 6 September 2026. Adapt and approve before use.
Purpose: record a rehearsal, not credentials or a security certification.

Do not enter passwords, key PINs, recovery codes, tokens or customer data.
Store completed records in approved restricted documentation.

SCENARIO AND APPROVAL
Ticket/reference:
Business owner/approver:
Authorised operator:
Observer/alert recipient:
Approved date, window and time zone:
Dependency assumed unavailable:
Services known to be operating:
Approved read-only administrative check:
Fallback access confirmed by:
Stop/escalation contact:
Account reference (restricted inventory reference, not credentials):
Designated workstation reference:
Evidence storage location:

STEP OUTCOMES
Use: demonstrated / not demonstrated / out of scope.
1. Authorisation and fallback confirmed:
   Evidence/reference:
2. Custody procedure completed:
   Outcome:
   Retrieval start/end times:
   Evidence/reference (never the credential):
3. Emergency sign-in:
   Outcome and time:
   Error category/reference if any:
4. Approved administrative view/capability:
   Outcome:
   Evidence/reference:
5. Sign-in evidence and notification:
   Event reference:
   Actual recipient:
   Observed time/delay:
   Outcome:
6. Session closed and custody restored:
   Outcome and responsible person:
7. Unexpected activity:
   Description/reference:
   Escalation decision:

CORRECTIVE ACTIONS
Finding:
Owner:
Due date:
Required retest:
Acceptance evidence:

CLOSEOUT
Scope demonstrated:
Not demonstrated:
Out of scope:
Approver/observer sign-off:
Next review date and owner:

This is a proposed worksheet, not a completed tenant test.
Source: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access