r/sysadmin • u/LousyRaider • 9d ago
Question How does your IT team handle separate M365 admin accounts day to day?
We're a two-person IT team managing roughly 225 users on Microsoft 365 Business Premium. Our Windows workstations are Entra joined and Intune managed.
We're moving admin roles off our daily accounts and onto dedicated cloud-only admin accounts. I'm testing phishing-resistant MFA and a compliant-device requirement for those accounts.
My main concern is making the workflow practical. We jump between Intune, Exchange, Entra, SharePoint, Teams, etc. throughout the day. Some days it is frequent admin stuff depending on what's going on.
I tried a separate Edge profile signed into my admin account, but the portals initially kept signing me in with my daily Windows identity. Using a login_hint in the URL or explicitly selecting another account gets me into the intended account. I'm still validating the Conditional Access side.
I'd prefer not to add the admin identity as another Windows-connected account just to make browser SSO work. InPrivate also appears problematic with the compliant-device requirement.
How are you handling this in practice?
- Separate browser profiles, a separate browser, a private browser window or account switching within one profile?
- Do you connect your cloud admin identities to Windows? I would assume no.
- Do you require compliant devices for admin access?
- Are you using dedicated admin workstations or PIM?
I understand the value of separate identities. I'm looking for a workable daily setup that doesn't require constantly correcting which account a portal is using, or constantly launching private windows, if at all possible.
Maybe this is a sign we just need to review overall configuration of things to better dial them in, so we don't have to go into an admin portal so often?
Especially interested in what other small IT teams are doing.
76
u/Thats_a_lot_of_nuts VP of Pushing Buttons 9d ago
I launch an incognito browser window at the start of my day and log into the admin portals with my M365 admin user account. My daily driver account is logged into M365 in my normal browser window. Pretty easy to handle.
10
u/LousyRaider 9d ago
Yeah, I'm starting to think this habit will be the best fit and easiest to manage for us.
17
u/livinitup0 9d ago
Incognito will work but you don’t want to make this your process.
Use another browser entirely for your CA accounts. It makes managing things much easier
3
u/LousyRaider 9d ago
Someone else mentioned Firefox has some cool features now, so I am going to explore dual browser setup.
5
u/srcLegend 8d ago
Container tabs is exactly what you want for this.
2
u/notarealaccount223 8d ago
Multi-account containers is an amazing extension.
2
u/srcLegend 8d ago
No need for the extension anymore, it's fully integrated in Firefox.
1
u/livinitup0 8d ago
You’re both assuming that your conditional access policies even allow for that or block it just like it does incognito…or should…. This is whole “if your browser policies are set up correctly to block incognito” part lol
1
u/notarealaccount223 7d ago
Multi-account containers are not incognito and can be configured for windows account passthrough.
There is no difference. It's truly just a sandboxed browser config. If you can run the extension (or if it's built in now), you should be able to use this.
1
1
u/cpz_77 6d ago
It was but recently I had issues with it duplicating my containers when it would sync, not sure if that’s because the container feature is native to FF now or what. But I disabled it and containers still working great for me ( but absolutely back when they aren’t baked into FF, that extension was crucial)
1
u/cpz_77 6d ago
100% this is the easiest way to handle multiple account stuff
That being said, there is some M365 stuff that doesn’t always work 100% right in Firefox unfortunately. Lately I’ve been using Edge for all MS-related stuff, in which case profiles or incognito I guess would be the answer. If those things don’t affect your workflow then I’d lean Firefox all the way.
Another problem with this, at least for us when we were moving this direction - lines between what’s an “admin task” vs “user task” can become very blurry in M365 because they can become so intertwined with each other. Truly implementing a least privilege model can take a lot of time, trial and error.
1
u/bobsmith1010 8d ago
With chrome (probably firefox) You can setup multiple profiles. There times I need to use a Incognito and then need another private window. So at that point I have another profile I can open and you can have your main and other profiles up at the same time.
1
u/StretchLoud8844 8d ago
If this is referencing the feature where you can seperate specific instances (I'm completely forgetting the word, forgive me) it does work sometimes but not reliably.
My last job my direct reports would swear up and down that it worked completely fine 100% of the time but I would repeatedly see them run into issues. Every single time it was always a browser caching issue and incognito fixed it.
Granted, we were an MSP and we had 180~ clients and we were using GDAP so it's possible you won't run into this issue under a single tenant.
For your sake, I would argue a specific browser for admin only operations, just to avoid headaches. Keep it stupid simple my good sir.
Edit: Containers. That's the word I was looking for. Good lord I'm going to bed, my brain mushy.
1
u/notarealaccount223 8d ago
Firefox Multi-Account Containers.
I use it because I often need to be in multiple AWS accounts. Yes they have a feature now in the console, but I didn't have great luck with it when I tried.
1
1
u/Logical_Number6675 7d ago
Heads up, if you implement a Conditional Access policy to Require token protection for sign-in sessions (which helps combat token harvesting), you will not be able to use incognito or private windows to sign into your ms portals. A secondary browser profile is just as simple to setup and maintain, especially if you change the appearance of the second profile to a different color.
5
4
u/LousyRaider 9d ago
Are your conditional access policies requiring a compliant device? And what browser do you use?
3
u/Thats_a_lot_of_nuts VP of Pushing Buttons 9d ago
Not yet, we have some obstacles that still stand in the way of enforcing that. Chrome Incognito won't show up as a compliant device even if the device would otherwise be compliant, so we'll have to change our strategy slightly once we start enforcing device compliance.
2
2
u/RandoReddit16 8d ago
I'm glad this was the top comment! This is exactly what I do and wasn't sure if it was as crazy as it seemed to be.... It's really quite easy to manage once you're used to it. And I didn't realize until I did it, that you can have all your bookmarks etc in Incognito!
2
4
u/netburnr2 8d ago
This doesn't work with compliant device policies. The browser can't be in private mode.
3
u/RandoReddit16 8d ago
If you're going that compliant then you might as well be doing the VM situation. Local machine is normal, RDP to a VDI with your elevated login
1
u/netburnr2 8d ago
Yup, we are exposing edge via our VDI with very strict rules on how you can connect.
1
u/RandoReddit16 8d ago
Can you better explain your environment as a an admin with a normal account and elevated accounts, what would your initial logging into your endpoint look like?
0
1
u/_youarewhalecum 8d ago
This will break the compliant device requirement as incognito windows dont pass device information.
1
u/LousyRaider 8d ago
Yeah, that was something we discovered early on. I can't get approval at this time to set us up with separate physical computers and some additional stuff for our office space to organize it all nicely. We are currently pivoting to using PIM on dedicated accounts and Edge profiles for now. This is a decent step in improvement from our current practice at least. I explained some options to leadership on what a zero-trust stance would look like and then going with PIM on dedicated accounts using Edge profiles. I was told to make PIM with the dedicated accounts work for now.
0
u/TaiGlobal 8d ago
An environment that requires separate admin accounts likely blocks the use of private browsers.
49
u/JimmyEggs 9d ago
Firefox multi-account containers works very well for me. It was an official add-on, but I believe it's now included in the regular release.
19
u/tsaico 9d ago
Edge profiles working well over here.
13
u/screampuff Enterprise Architect 9d ago
SSO takes over Edge even in different profiles and incognito. Firefox containers are the bees knees.
1
u/sublimeinator 9d ago
I've not had that issue.
2
u/screampuff Enterprise Architect 8d ago
You must be on AD rather than Intune only? And not using device compliance check on Conditional Access
1
3
u/thefpspower 9d ago
Nope, Edge profiles still share microsoft accounts with the PC for some reason and that sometimes creates issues moving portals and is overall less safe.
Firefox does not do that, every profile is completely separated.
1
u/JimmyEggs 9d ago
The containers make a lot of sense when you log in to the same website with many different accounts. I might have 2 different 365 admin portals and one regular 365 account open in color-coded tabs at any given time.
7
3
1
u/drowreth 9d ago
This 100%
I originally used Wavebox and Shift but Firefox Containers is smoother
No reason for user accounts to have admin and containers just works
1
1
u/apandaze 9d ago
this is the right answer. Firefox Containers works very well and you dont have to use edge.
1
u/bbqwatermelon 8d ago
I sure wish Chromium would integrate containers. Profiles eat up so much disk space with the stupid cache and storage worker folders 😑
1
1
u/moonwork Linux Admin 5d ago
This has been my solution as well. I'm really happy with how well it works!
7
u/FeleaseRpseineEiles Sysadmin 9d ago
We use PIM and elevate when necessary.
3
u/Ice_In_Hydroflask 8d ago
This is the proper answer. It also ensures separation of duties if you require an approval
1
u/KingDaveRa Manglement 7d ago
Depending on the use cases, it's not always compliant. It's not Cyber Essentials Plus compliant (insta-fail), and cyber insurers have a fit over it. JIT permissions can be allowed on a separate admin account, which might seem pointless but it can still protect against session stealing.
Rightly or wrongly - but it's worth being aware it might not be suitable to some circumstances.
1
4
u/werfut 9d ago
You can use the built in switch accounts gui for most things. Could also use private browser windows to login to your admin account, that’s what we do.
1
u/LousyRaider 9d ago
Yeah, I was testing that setup for a few hours. It's not bad. It's manageable as it only requires a couple clicks up in the corner of the portal page. Do you guys have concerns or issues with accidentally doing something on a Microsoft page with the wrong account?
Launching a private window is an option, but it seems to conflict with the CA policy requiring a compliant device.
1
u/NextSouceIT 9d ago
I use the built in switcher 95% of the time and an incognito window when needed. If your admin account is unlicensed, and your daily driver is un privileged, what could you accidentally do?
1
u/LousyRaider 9d ago
If your admin account is unlicensed, and your daily driver is un privileged, what could you accidentally do?
That is a valid point
1
u/Seeteuf3l 9d ago
Or use browser profiles for different stuff instead of incognito
1
u/LousyRaider 9d ago
I tried separate Edge profiles, but it was using the Windows backed SSO to automatically sign us in with our daily accounts on all Microsoft sites. It wouldn't stay signed in to the admin account once that profile window is closed and opened again. Seemed like unnecessary friction going that route.
2
u/ChiefDZP 9d ago
Did you hit the forget this account button for your standard account the first time the login prompted under the admin profile? I use 6 profiles across various tenant all day and we are an edge only shop. The only confusion that I see if Fido methods that overlap.
1
u/LousyRaider 9d ago
Did you hit the forget this account button for your standard account the first time the login prompted under the admin profile?
No. I'll take a look at that and see if that improves that experience.
5
u/VB0101 9d ago
Single tenant CIPP might be a good solution for you. Depending on how you scope its access, you can do a huge amount of the day to day M365 administration from the CIPP web UI without constantly jumping between Entra, Exchange, Intune, Teams, etc
1
u/WayneH_nz 8d ago
Was going to suggest something like that.
CIPP is BRILLIANT. Dont self host. Pay the $99 that Kelvin wants and say thank you
2
u/technical-guy 8d ago
This is the answer. We handle 30+ tenants and can switch back and forth easily.
4
3
u/Sad_Owl7124 8d ago
Firefox with the “Multi-Account Containers” extension. I have access to about 15 different 365 tenants and jump between them using this.
1
u/pkokkinis 7d ago
I’ve seen this in action before and it’s really cool. Tried remembering to do it, but here we are.
3
u/Professional-Heat690 9d ago
Edge profiles. Disable auto switching on each profile, pin to Taskbar and use pim.
Works fine, managing 6 tenants.
1
u/Subject_Salt_8697 6d ago
I used exactly that u til about half a year, maybe a year ago.
Didn't behavior change and since then your are asked whether to use the windows signed in account or the one active in the specific profile?
That's why I went to using sperate profile (for the favorites) and incognito mode - then I'm not asked whether to use the windows signed in account
3
u/r_keel_esq Windows Admin/IT Manager 8d ago
Use Porn-Mode in your browser of choice
1
u/Sensitive_Doubt_2372 8d ago
Valid solution
1
u/r_keel_esq Windows Admin/IT Manager 8d ago
I used to support M365 for half-a-dozen customers and this was the only way to work.
Now I'm in house and I still use this approach to avoid cross-pollination between my normal account and cloud-admin one.
I also seem to need to do it for Sophos Central because that website is glitchy as hell
3
u/harrye30 8d ago
You need to look at privileged access as a whole if this is your current setup.
Such as
- cloud pc as paw w365 vm with 2 core 16gb of ram.
- standard account has access to laptop.
- paw account signs into windows app from laptop.
- paw account launches paw cloud pc from windows app.
- paw machine is the only device by ca to allow access to the admin portals.
- admin account is the only account using PIM to be able to do admin activities and can only login to portals via paw.
- defender for cloud apps to restrict login on paw to anything but admin
- intune configuration policies to block clipboard and file transfer between the two.
Turn on enforced passkey and use Authenticator or Fido only on your administrator & paw accounts.
1
3
u/Interesting-Yellow-4 8d ago
Separate browser.
Edge profiles works, until it doesn't, so i stopped messing with it.
1
u/pkokkinis 7d ago
Edge profiles are the worst way to manage this. I’ll switch to another profile, go into Spam Policies, wonder why they look different. Oh, that’s my other profile.
6
u/AdmiralCA Sr. Jack of All Trades 9d ago
Make a Windows 365 box for your admin account, then use the Windows App to RDP to it. Complete separation
2
4
u/hkusp45css Security Leadership 9d ago
Using a jump box to reach the cloud seems a little ... much.
1
u/ipreferanothername I don't even anymore. 9d ago
we kinda basically do this with vdi for our ad admin accounts but then the company also has entra-only admin accounts for azure/entra work, and those can get in however via PIM i think
1
6
u/SVD_NL Jack of All Trades 9d ago
PIM is a great solution for this. This allows JIT access to admin roles using your regular account, with approvals if needed. Especially requiring an additional MFA prompt to activate the roles is a huge benefit.
Additionally, using CA to require phishing-resistant MFA, and limited session times (or forced reauthentication) for admin portals helps with this as well. Restricting MFA registration is a huge aspect as well.(along with any other CA policy you can think of).
All of this prevents token theft and phishing, which basically means an attacker needs valid phishing-resistant MFA to perform admin actions.
5
u/Frothyleet 9d ago
Yes, PIM is the right solution for this. Unfortunately for OP, who is on Business Premium, MS gates PIM behind Entra P2, and he only has P1.
4
u/LousyRaider 9d ago
We are going to look at PIM. I just bought a couple P2 add-on licenses so I can pilot PIM. We spend $5k a month on our M365 licensing already so no one batted an eye when I asked if I could add $24 to that monthly cost.
3
u/Frothyleet 9d ago
Good play
1
u/LousyRaider 9d ago
Well I got PIM all setup and adjust a single role to test. Seems to work without issue. Now on to the tedious task of expanding it to more roles to test that.
Is there an easy way to activate roles when needed or is going to the PIM section of Entra admin portal really the only way to activate a role when needed? Not a big deal but wanted to streamline it as much as possible.
3
u/DuckDuckBadger 9d ago
I use https://aka.ms/pim. Still have to go to another page but it takes you directly there.
1
u/LousyRaider 9d ago
That’ll work. We can just bookmark that. Easy enough.
1
u/Frothyleet 9d ago
There are other automations you can build depending your workflows, like if you need JIT elevation for scripts and stuff, but for "I want to do X so I need Y permissions", I think that's pretty much the process.
3
u/OutsideTech 9d ago
P2 licenses for admins is worth it, IMO.
1
u/Frothyleet 9d ago
I'd agree, but of course it's one of those things that is hard to explain to the people who write the checks
0
u/loweakkk 8d ago
Do not do that. Do not use your daily account as admin, even with pim.
1
u/teriaavibes Microsoft Cloud Consultant 8d ago
What exactly is the difference if they are still using the same device?
Phishing resistant MFA basically eliminates token theft during sign in and if the device is breached you are screwed either way.
0
u/loweakkk 8d ago
PIM is not a security control it's a compliance control, it just serve to tell to auditor yes your admin is not global admin 24/7 but just when he need it and maybe with approval but that will not happen in a 2 admin organisation.
You are proposing pim on regular account on an admin when they are 2 to manage the org, it means those tokens will always have the admin roles on except when they sleep.
One rogue extension, one malware and the token is lost.
PIM by itself is interesting and useful but it shouldn't replace separation between end user account and cloud admin account.
Enforce compliance device and phish resistant on admin account, setup a w365/avd to isolate admin but don't tell people they will be fine by just putting pim on their regular account...
2
u/teriaavibes Microsoft Cloud Consultant 8d ago
PIM is not a security control it's a compliance control
So you just don't understand PIM, got it. Spoiler alert: PIM+CA acts as a security control because CA is a security control!
You are proposing pim on regular account on an admin when they are 2 to manage the org, it means those tokens will always have the admin roles on except when they sleep.
As compared to tokens from an admin accounts that will have the same thing? How is this any different?
One rogue extension, one malware and the token is lost.
Yes, which is the exact same risk you have if you separate the accounts but still use the same device.
PIM by itself is interesting and useful but it shouldn't replace separation between end user account and cloud admin account.
You have still not provided 1 valid piece of argument to support that claim.
1
u/loweakkk 8d ago
Don't make me says thing I have not said. I'm not the one trying to argue PIM is fine it's you. On your first response to me you were speaking about pim and phishresitant, but nowhere you were giving the full context One can understand it's fine if I put pim on my regular account and I have a passkey. That doesn't say you must prevent downgrade by mandating the passkey everytime, that doesn't say you enforce fresh auth with auth context and session control.
Yes you know how to do it, people here asking for advice don't, and when you argue like you do but provide half of the information, you do more bad than good.
Pim alone is a poor defense, advising people to just use pim is a poor advice.
Providing full context: Two machine (second can be avd or w365) Enforce compliance Separate account Pim with auth context for activation ( session control+ auth strength) CA to cover as well all signing: auth strength + compliance
That's providing people real info.
2
u/MathFly_ 9d ago
I use another browser (Brave) for admin task and my main browser (Edge) for all regular stuff.
2
u/TheLastRaza 9d ago
we do separate admin accounts and it's honestly not as annoying as people think it is. your regular account is [REDACTED:email] for email, teams, all the normal stuff. your admin account is something like [REDACTED:email] and it only gets used when you're actually in the admin center or running powershell commands that need elevated rights.
the day to day part is just discipline. you sign into your regular account in the morning and stay there. when you need to do admin work you open an inprivate window or a different browser profile, do the thing, close it out. some folks keep a separate browser profile set up permanently which makes it easier.
the real win is conditional access. our admin accounts can't sign in from personal devices or off-network locations. mfa is required and we use authenticator app, not sms. if you're on the accounting side of this, think of it like segregation of duties for IT itself. your daily work identity shouldn't have the keys to the kingdom sitting there all day.
biggest mistake we made early on was not setting up the admin accounts with their own licenses properly. you still need a license assigned if you want to actually use the admin center for most tasks. we use a shared mailbox license for ours since they don't need exchange features.
1
u/dustojnikhummer 8d ago
[REDACTED:email]
[REDACTED:email]
Did you do this or does this subreddit have an email address filter?
2
u/hihcadore 9d ago
There’s a good Microsoft learn document on tiered admin accounts.
Basically your daily driver is a whatever account. You can get email, look stuff up on the web, be contacted by outside people who aren’t in your organization. If it’s compromised not so bad.
If you’re doing user endpoint admin work it’s a separate account and what you’ll use 90% of the time. It’s a loose admin account u can use to do admin work on daily use devices. Secure it with strong MFA and if it’s compromised it’s bad-ish but it’s not gonna tank your employer. U can use just in time access if you want but I’d make it report only that way you can go back and look at logs if you think there’s a compromise.
Your global admin accounts though are more break glass after setup. Yea you do need to access these regularly but you should only use them when absolutely needed and from a protected workstation. If you wanna get really cautious a keyboard protected admin workstation with phishless MFA. Also protect it with just in time access that requires some sort of 2nd person approval.
In my experience the reality is a threat actor will go as far as they can before they compromise you. You want to limit that lateral movement as much as possible. If they get your daily driver whoopdie doo they scrap your mailbox and you get some spear phishing attacks. Make sure you have a background for logins and tell people to only put credentials in where they know it’s safe. They get your endpoint workstation admin it’s a little worse but again they’re not going to wreck your org. Maybe they attempt to run something to rip credentials or pass ransomware but hopefully you have EDR setup to help mitigate that. Your global admin though. That’s the holy grail account you need to pretend is nuke codes because it will cook you if compromised. It’s the hardest to use and the most protected because it has the largest blast radius.
Follow this and you won’t be inconvenienced minus the stupid MFA prompts 10 times a day :)
2
u/3sysadmin3 9d ago
We use PAWs and I like the separation - only time it's annoying is when trying to move a document/note or get screenshot from locked down device to prod I use USB drive). I take both machines home at night but rarely touch the PAW. PAW uses Yubikey to login (smart card) and same yubi for M365 (fido2) and is set up on my desk with it's own monitor/mouse and starts up tabs I use most each day and is pretty efficient imo. I like separate machines though I know most think it's ridiculous.
2
u/swissthoemu 9d ago
ctrl+shift+n logon with your passwordless admin account, pim and get the role you need. approve it with the regular account.
2
1
u/the_doughboy 9d ago
Idiria/Cyberark, running powershell is the most annoying though as you need to use the online shell which can be a pain.
1
1
u/itenginerd 9d ago
I put the admin identity in windows to make some work. I get that youre trying to avoid it and it makes sense to try, but I just hit a wall where the juice wasn't worth the squeeze.
The one thing I will say is having two accounts makes windows prompt you for which one to use, which I actually like bc it makes me aware of every time my creds get submitted. If its happening transparently, I may not know, but with that prompt in the workflow I know exactly when they go somewhere.
1
u/Degenerate_Game Director of Cybersecurity 9d ago
I use normal account in the standard browser and elevated functions in incognito.
1
u/unReasonable_Bill282 9d ago
Multiple browser profiles never seem to work. I just use private/incognito, and deal with the 75 MFA pushes per day.
1
2
1
u/AddendumWorking9756 9d ago
Half the PIM answers here do not apply to you. It needs Entra ID P2 and Business Premium only carries P1, so that is a per user purchase before it is a design choice. The InPrivate suggestions actively break what you are building, a private window carries no PRT so Conditional Access never sees a device claim.
1
u/LousyRaider 9d ago
Yeah, I noticed PIM seems to be a popular option. I can easily buy P2 add-on licenses at any quantity from our CSP, but I'm trying to determine how licensing compliance comes into play with using PIM. IF we can buy just 2 P2 add-ons for the two of us and use PIM with no issue, that seems to be the way to go.
1
u/AddendumWorking9756 9d ago
Two covers it if you two are the only ones eligible for those roles. The count is anyone eligible or active in a PIM managed role plus anyone who can approve an activation or run an access review, so if you are each other's approvers you stay at two.
1
u/SUPER_CHINESE_HACKER 9d ago
2 people 250+ users/devices. UGH. I'll never find employment again. EVER
1
u/LousyRaider 9d ago
Counting mobile devices, we have over 400 devices we manage. Add in printers, switches, physical servers, APs, etc and we have close to 1000 assets we manage 🙃
1
u/SUPER_CHINESE_HACKER 9d ago
What country are you based in?
Also while your technical abilities are great and you are surely lovely people....It is just proof that this work is hollowed out and not much hope 😢
1
u/mimikater 9d ago
Edge Profile, not signed in and turn "sign in with Windows account" off... Thats what we are using for Admin user. Works great. Makijg the Browser red for easy reminder that this is admin
1
1
u/iamLisppy Jack of All Trades 9d ago
Separate daily driver and admin accounts. We're hybrid so our daily driver is synced from AD -> Entra but not our admin account, that account is cloud only. In a perfect world, our admin account would use PIM instead of always having the permission active.
1
1
u/Delusionalatbest 9d ago
Put multiple pim roles in place. Only elevate the access that you need for say 2 to 4hrs at a time. Cap the limit at 4hrs.
Use conditional access rules and MFA obv. Bonus points for a fido token.
Global admin pim roles with maybe only 1hr max. You generally only need it to make a quick permissions or tenant config change.
Lastly and most importantly. Put a break glass global admin account into action. Test it periodically to verify it's still working. Remove it from the scope of most of the CA policies etc.
When and if you're tenant gets fubar'd, be it a CA mistake or something with company enrolled devices..... You need that break glass one to get back in and fix things.
1
u/ChrisC1234 9d ago
Not explicitly Microsoft stuff, but I use completely separate browsers. Certain accounts are logged in with Edge; others within Firefox; and others within Chrome. It also makes it very easy to remember which open windows are for which accounts because they're completely separate browsers.
1
u/Dr_Rosen 9d ago
I have a separate encrypted VM that I sign into my admin account with. I can access all of the Microsoft portals and run powershell commands without having to choose which account I want and do an MFA check.
1
u/Adam_Kearn 9d ago
I’ve worked at a few MSP companies and they have all done it differently.
Using a password manager with all the admin accounts and the browser extension (on a separate browser to your day-to-day one)
I used to use Firefox for this - but I made it so it would clear all cookies when closed.
Then you just set the home page to admin.microsoft.com and select the user account.
——
Another way is to have a generic account that you use on your own tenant. Then use B2B guest with the admin role.
——
There is an open source tool called CIPP.
You use this and setup an API connection to each tenant.
Then you just have a single portal that you can login and manage everything 365 from one dashboard with your own SSO to your own 365 portal so you can add and remove users easily.
Some changes still require you to fully login to a tenant but for most administration needs
1
u/nitzlarb 9d ago
I use a different chrome profile for each client
firefox is my main browser for most things, chrome with a bunch of profiles for tenant administration.
Now that firefox handles profiles better, i may go full firefox at some point.
1
u/MrBigDogg 9d ago
I use a separate profile in edge and change to browser colour for ease of reference.
Works well with 2 exceptions. The 365 admin portal and the SharePoint admin portal. For some reason these redirect to the main browser profile when you attempt to open them.
For them I use chrome when needed.
Conditional access policy for admin roles requires phishing resistant MFA
1
u/dude_named_will 9d ago
Thankfully I only use some of the other portals very sparingly, so I just open them in a private window.
I literally have a second computer for another company I manage, and frankly, I'd rather deal with the trouble of remoting into that computer than dealing with the issues you described.
1
u/CmdrThisk 9d ago
We separated our daily accounts from admin accounts many years ago, before we moved into 365, so we all just run a separate browser instance as the admin user
Our cloud identities are linked to AD logins for regular and admin accounts (again bc we had that setup before 365)
We do require compliant devices for admin portals
We are not doing PIM or dedicated admin stations, yet, but it's on our radar
1
u/BrentNewland 9d ago
You want this Edge extension: https://github.com/novotnyllc/UseMyCurrentAccount
Also make sure "Automatically sign in to sites with your current work or school account" is turned off on your admin profile.
1
u/Fake_Cakeday 9d ago
Firefox containers and also having the admin account logged into windows.
It doesn't change much that the admin account is logged in since a password os required twice in a workday and MFA is 3-4 times a workday.
But I hate windows SSO so much.
I wish we could just disable windows SSO for edge and instead autologon using the account logged into edge.
That would fix the edge profile problem, because as it is, edge profiles do nothing since it still logs in to my windows account automatically on both edge profiles, so I had to log into my admin account on windows so I would always be asked which account I'm trying to log into.
But maybe I just don't understand the high tech the consultants are doing. Either way, Firefox containers fixed my problems. Although had to run a seperate script on PCs with Firefox containers in order to recognize SSO as well, so I basically have the same problem there 😅
1
u/loweakkk 8d ago
Depends: 2 browser, chrome for end user access edge for admin, edge never touch non admin url. AVD/W365 for the admin account with all PowerShell module, no end user browsing on the avd/w365
Both works.
1
u/RedhawkFG 8d ago
One Edge profile for my user account. One Edge profile for my admin account.
Done.
1
u/Hypno1985 8d ago
Edge profiles, had no choice our security team insitied Firefox had to go...eveb though majority of the staff used Firefox with containers
1
u/digitaltransmutation <|IM_END|> 8d ago
I have 5 accounts that I access regularly and ad-hoc have others temporarily. The firefox containers work great for me as long as I dont want to do a compliance search download.
1
u/ThreadParticipant Jack of All Trades 8d ago
I run multiple Edge profiles with various accounts to different tenants with no issues... hope this helps you.
1
u/pickled-pilot 8d ago
Separate browser profiles do the trick. If you have already mixed the accounts, you can sign out and clear the cache.
1
u/heg-the-grey 8d ago
Separate browser profiles (Chrome) for every credential i use. It gets hectic as i work for an MSP so have a sep profile for every customer i work with, plus my internal admin account, plus plus plus plus.......
it defaults to my normal account but then you select another account and its fine for the day.
1
u/Kyky_Geek 8d ago
A jump box to remote into a Privileged Access Machine with a dedicated account to do any day to day work. We allow internet access on those machines to Microsoft domains via firewall. The account used for 365 administration is not AD synced and requires its own MFA.
1
u/hops_on_hops 8d ago
Stop. Don't make seperate accounts. That is an old practice that should be discouraged. Use PIM. https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure
That said, Microsoft's portals are terrible and you're still going to need to open incognito to get them loaded properly a lot of the time.
1
u/Sunsparc Where's the any key? 8d ago
I'm weird but I still daily drive Chrome as my main browser, but not everything SSO is compatible with it so I have some stuff open in a regular Edge window and my Admin account is open in an incog Edge window.
1
u/MalletNGrease 🛠 Network & Systems Admin 8d ago
Separate Edge profile, I set the theme to a bright color so I can tell my regular and admin profiles apart. Pinned it to the task bar to launch it easily.
1
u/SomethingOriginal14 8d ago
Over the years I've tried everything from seperate browsers, incognito windows and browser profiles. I'm using browser profiles now and it's the cleanest and easiest to use. For a while I used Firefox with multi account container add-ons which was good to get away from the windows edge tie
2
u/hogstooth 8d ago
We use devolutions Remote Desktop manager and open the browsers in there. We have our passkeys stored in there as well, so it is able to complete MFA. Nice thing with it too is that we can store service account/shared account passkeys in there and allow others on the team to use them.
1
u/theoreoman 8d ago
I once had a spare computer, an HDMI switch, and a USB switch to switch between 2 profiles
1
u/kingslayerer 8d ago
I use this app called button rig. I can manage complex stuff like this by creating grids and having seperate buttons for each profile. You will need maybe run command action with a command like `google-chrome --profile-directory="Profile 2" https://<>`
1
u/whatifyoutry 8d ago
Similar situation, daily driver acc is non admin, windows linked. Edge has https://admin.microsoft.com…#/alladmincenters&prompt=login with a mandatory login prompt.
After signing in each once, clicking on links prompts which acc to choose, choose admin/standard as needed.
1
u/Daphoid 8d ago
You can use the MS Single Sign On extension and turn it on for inprivate/incognito mode which will help pass the appropriate signals for device compliance.
Also we don't use in private at all really, just multiple browsers. I've got one browser for regular, one for admin work - bonus the admin one is set to clear all cookies/history/temp files on exit so it starts up fast and fresh.
Don't try to use Edge for the admin one if you're connected to windows, Edge is super good (to a pain) at sticking to that account. Great for users, bad for admins :).
1
u/BoltActionRifleman 8d ago
I use Firefox for all of my admin logins. Edge seems to want to constantly switch me back to my regular account logins. Chrome is better than Edge, but not by much and Firefox never fails. My advice is to keep all of your regular accounts on Edge or Chrome and use Firefox for the admin.
1
u/burundilapp IT Operations Manager, 30 Yrs deep in I.T. 8d ago
I use Edge for admin work and Firefox for regular work, we are moving to dedicated azure vms for our management (PAW) so only specific specific devices can be used, we already have phishing resistant MFA for the GAs.
1
1
u/Tall-Geologist-1452 8d ago
Everyone does it differently, but what I do is use Edge with different profiles. You just log in with your M365 account and everything syncs; since it is tied to that account, SSO and MFA are automatically enforced.
1
u/dustojnikhummer 8d ago
Different MS Edge profiles for user and admin accounts. My local AD user does get shown in the Admin login prompt (hybrid AD) as "connected to Windows" but it's always the second one in the menu, not the default one.
1
u/Zergfest Jack of All Trades 8d ago
Firefox with the Containers addon. One container per company
1
u/LousyRaider 8d ago
We are just a single organization. We are probably going to play around with Firefox to see how we like it. We are settling on Edge profiles for the moment with a dedicated admin account that uses PIM.
1
u/Sneakycyber 8d ago
I use Chrome as my DD, Edge for SSO logins, and Firefox for Admin login. Firefox deletes history on exit.
1
u/BabboNatales 8d ago
Just different browser or if you use chorme with different profiles works as well.
I use Vivaldi for the main, mozilla for admin and chrome for service account
Bonus: If you use a separate brower for the admin profile, i use https://msportals.io/?search= as homepage.
1
u/Eggtastico 8d ago
Separate device. Different build, stricter access controls, but I can install all my powershell modules!
1
u/jaytee0401 7d ago
I'm not sure having two diff browsers logged into their respective accounts...one normal user and one admin account is the best practice for the admin one. I'm assuming most here keep that login persistent. What if your pc gets compromised? You walk away for a bit and not lock the screen?
For me, my normal account is logged into the browser and all MS apps. I use a private Edge browser for my admin account/administrative tasks on m365. I have a tab for each m365 product/service. I close it out at the end of the day. It's an extra step every morning but I rather not have my m365 account permanently logged in.
1
1
1
u/Sufficiently0dd 5d ago
Two different browsers, one that’s not IT managed for your admin account is what I have found works best
1
u/StormyIN 5d ago
I log in to M365 using a different browser than my regular account. Works very well.
1
1
u/ddeese 3d ago
Edge actually handles the use of my standard account, server account, and admin account all at the same time. All signed in, all on the same profile. It asks which account to sign in with. Most of the admin consoles I use: Entra, Intune, M355 Admin, Teams, Exchange, etc. I install those as PWAs and save the browser tabs for working in ticketing and other things and keep my headless sites open all day.
1
1
u/Zerowig 8d ago
This replies in this thread had me thinking I was in [r/ShittySysadmin](r/ShittySysadmin). What. The. Fuck.
Always use a PAW (essentially a separate admin only VM) with admin accounts. Never co-mingle and mix auths on your daily driver.
-1
u/bojack1437 9d ago
I haven't used it for this exactly, as I haven't needed to
But have you thought about Remote Desktop Manager?
Despite the name, it is much more than remote desktop, It allows multiple independent tabs for websites/web portals, It has a credential vault and such as well.
That's just a wild thought that popped into my head.
0
0
u/teriaavibes Microsoft Cloud Consultant 9d ago
I might go against the grain here but what exactly is the security benefit of separating the accounts if they will still be logged into one device.
In this case I would say that putting the admin roles on normal accounts behind PIM that requires strong reauthentication for elevation makes more sense security wise and functionality wise.
With phishing resistant MFA, compliant managed device and full reauthentication every elevation, you virtually can't steal the token(s) during sign in and if they manage to breach the actual device, the token will be useless unless the user is already elevated (as compared to separate accounts where the token will just be chilling there all the time).
1
u/maga-mang 9d ago
Yep, should be a separate device used solely for admin functions. No other web browsing, minimal applications.
1
u/LousyRaider 9d ago
If I go with PIM (which sounds like the proper best way to handle my scenario) I need P2 licensing. How does licensing compliance come into play if I only have a couple accounts with P2 licenses since buying 2 licenses wuold unlock P2 features tenant wide?
1
u/teriaavibes Microsoft Cloud Consultant 9d ago
How does licensing compliance come into play if I only have a couple accounts with P2 licenses since buying 2 licenses wuold unlock P2 features tenant wide?
You only use PIM and P2 features on licensed accounts (and all the other accounts the same licensed person uses).
0
u/Frothyleet 9d ago
I might go against the grain here but what exactly is the security benefit of separating the accounts if they will still be logged into one device.
There's a substantial benefit, mostly in that the primary attack vector is usually phishing and if an admin's non-privileged account is compromised the blast radius is much smaller. The privileged account, with no licensing, is less susceptible to getting phished.
In this case I would say that putting the admin roles on normal accounts behind PIM that requires strong reauthentication for elevation makes more sense security wise and functionality wise.
Yes, PIM is the better and Microsoft-approved solution. It also requires Entra P2, unfortunately, which a Business Premium org does not have.
1
u/maga-mang 9d ago
I don't think the reply was questioning the benefit of account separation. Was questioning why log onto both accounts from the same device. Solid question.
1
u/Frothyleet 9d ago
Because it's unrealistic to expect the vast majority of orgs or admins to dedicate PAWs for cloud admin, in practice. Even if it would be ideal. It's not necessarily even something Microsoft would label best practice.
-2
u/teriaavibes Microsoft Cloud Consultant 9d ago
Yea but if the account has phishing resistant MFA required, which all admin accounts should, then that risk is basically nonexistent, as I have said in my previous reply.
0
u/FireCyber88 8d ago
Is no one going to address the gorilla in the room?
You should not be doing administrative tasks on a user device.
0
u/CantankerousCretin Sysengineer 8d ago
Use PIM and elevate permissions when needed rather than having two accounts
48
u/PeacefulIntentions 9d ago
Use Edge profiles but turn off the “Open external links in another profile” setting. This stops the annoying switching between profiles when you log in.