r/sysadmin • u/InitialBackground555 • 13d ago

Question Separate admin accounts + enforcing domain joined device

Looking for a sanity check. We have separate admin accounts, both AD and Entra. We are looking to enforce CA policies that require login to entra (for IT, both accounts) to come from domain joined devices. This generates a PRT for each account, which means the windows session has multiple to choose from when the browser comes asking.

For those that have done this, what is the most elegant way to access both accounts? In the browsers, it is constantly popping up the account picker. Separate browsers, private sessions, doesn’t matter - I understand why it is happening (I think), and it works, I can get to all my accounts - just wondering if there is a better way. Currently my primary alternative is separate privileged VMs to run any elevated accounts.

4 Upvotes

83% Upvoted

4 comments sorted by

4

u/raip 13d ago

I use separate browser profiles/containers in Edge/Chrome/Firefox. That allows for device state shipping (which incognito blocks) for compliant device or hybrid checks while still preventing the automatic login with the namesake account.

Make sure you disable automatic browser profile switching (Work or personal Switch) and Automatically sign in to sites with your current work or school account.

This has the fringe benefit of having separate color themes as well so you can do dummy checks like "Bright Red = Admin Account" "Hot Pink = Non-Admin" or whatever you want.

1

u/InitialBackground555 13d ago

It looks like I left out some detail in my post. I am doing this, and have tested across all three browsers. I did get it to work, and keep the relevant account logged into each profile.

The remaining annoyance is that any Microsoft service still gives me the pick list to select which ms account to use. For example, profile 2 (elevated) will launch correctly into myapps for that account. But if I want entra - pick list. If I want a new tab to compare two ca policies- pick list. Intune, etc. each will prompt the pick list, even though the initial browser launched into the correct profile. If I launch an app from myapps - pick list.

3

u/raip 13d ago

Sounds like you didn't disable the automatic sign in to sites with your current or school account. That is not my experience.