Needs to be stored someplace that doesn't require MFA. At least not the same MFA provider. Somewhere in the docs, I believe they recommend splitting the password into pieces, writing those down on individual pieces of paper, and storing them in physical safes at different locations.
#break Glass account
versed stream
May be a bit overkill, since you'd be locked out if you can't retrieve one piece of the password. Couple of our clients keep the entire pwd written down in more than one physical location so that at least a couple high ranking people can use it if needed.
And of course auditing whenever the account is used. Logging into it should set off a lot of alarm bells.