SSO recovery codes
Why Tier 0
They let an owner reach the organization or enterprise when the identity provider is unavailable, so they bypass the IdP and its MFA and conditional access. A break-glass credential at the top of the tree.
One-time codes an organization or enterprise owner downloads for signing in when the SAML or OIDC identity provider is down.
Available on: Enterprise Cloud (organization or enterprise SSO), EMU (used by the setup user). Source
Attack path
Recovery codes are often saved once in a shared drive or a password manager entry nobody watches. With an owner's password and these codes, an attacker signs in without the IdP ever seeing it.
Mitigations
- Store recovery codes offline or in a restricted password manager vault
- Alert on their use in the audit log, and regenerate them after use
Detect
Alert on business.recovery_code_used, org.recovery_code_used, business.recovery_codes_downloaded, org.recovery_codes_viewed in the audit log.
Related permissions
GitHub Docs: Downloading your enterprise account's single sign-on recovery codes