Explanation:

According to the Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Entra ID documentation, a break-glass account (also known as an emergency access account) is a cloud-only account that must not depend on any on-premises identity infrastructure, such as Active Directory synchronization or conditional access.
* Location:The break-glass account must be created directly in Azure AD (cloud-only) - not in an on- premises Organizational Unit (OU1 or OU2).
* OU1 syncs with Azure AD, meaning if on-premises synchronization fails or the domain controller is unavailable, accounts in OU1 might not authenticate.
* OU2 doesn't sync at all, so creating the account there wouldn't provide Azure AD access.
Therefore, the only resilient option is Azure AD (cloud-only) to ensure access even if directory sync or on-premises systems are unavailable.
* Role:Microsoft recommends assigning the Global Administrator role to break-glass accounts. This ensures full tenant recovery capability in emergencies such as Conditional Access lockouts or MFA misconfiguration.
* The Billing Administrator or Privileged Role Administrator roles don't provide sufficient rights to recover access or modify Conditional Access settings.
* The Global Administrator role has full control over all Azure AD resources and configuration settings.
Microsoft documentation states:
"Create at least two cloud-only emergency access accounts with the Global Administrator role. These accounts must be excluded from Conditional Access policies and protected with strong authentication methods."