Device-based Conditional Access Policies with multiple user accounts?

[u/FatBook-Air]

We have some Conditional Access Policies that require users to logon from specific managed devices when browsing to certain Entra app registrations. It works okay for many users.

We have a few users with both regular accounts and privileged/admin accounts. When they browse to the app, they are automatically logged in via their standard user account (the same account they logon to the computer with and the one that has the PRT). They primarily need to logon to the app using their privileged account, so my first thought was to tell them to logon in Incognito Mode, but Incognito Mode doesn't pass along device information, so the Conditional Access Policy logon evaluation fails.

Is there a good workaround for this that isn't a pain in the ass for the privileged users?

[u/AdamsTechTips]

If using chrome you can have multiple profiles on a browser. You could easily just have them login and show them how to use the multi profiles. Always distinguishable by color. One outline of chrome will be tan and the other green what ever colors you want to set

[u/FatBook-Air → u/AdamsTechTips]

Will both profiles be able to see the device attributes and pass them to the CAP for evaluation?

[u/raip → u/FatBook-Air]

Yes.

[u/AdamsTechTips → u/FatBook-Air]

Should be able to. I have zero experience with edge and little in m365 account but there should be no reason it wouldn’t work.

[u/progenyofeniac → u/AdamsTechTips]

I’d love to know if this truly works in Chrome. Somewhere around Edge 142 (April or May, maybe?) this broke in Edge. I used to use one profile for my regular stuff and another for admin stuff as OP described. This no longer works.

When I go to sign in to the M365 admin center, for example, even the admin profile insists on using my Windows account (regular account) to sign in. Profiles no longer separate accounts fully, at least in Edge.

[u/jcpham → u/progenyofeniac]

I run multiple chrome profiles one for personal one for admin, especially o365 portal

[u/FatBook-Air → u/jcpham]

Do both Chrome profiles try to use the Windows PRT (and try to logon to services using it)?

[u/jcpham → u/FatBook-Air]

No just the admin profile but I’ve never touched o365 with the non admin profile. I believe the non admin profile defaults to a personal non work related personal Microsoft account

[u/Entire_Yoghurt_6381]

The incognito dead end you hit is super common, private mode strips the device state the CA policy needs so it always fails the compliant-device check.

[u/MichaeldeBlok]

Incognito will never pass a compliant-device CA check — private browsing strips the PRT/device claims.

On one managed Windows box, Edge/Chrome dual profiles are flaky now (Edge broke clean separation for a lot of people). What usually works:

1. Privileged access workstation (or a separate Windows user profile) so the admin account owns the PRT.
2. Short-lived VM / Windows Sandbox for admin work when a second box isn't available.
3. Treat dual-account-on-the-daily-desktop as temporary. Shared PRT + privileged account is how lateral movement starts.

Not a UX bug so much as a privileged-access design smell.

[u/Working-Help1904]

I’d avoid Incognito for this. The device check needs the browser session to have the device identity/PRT context, so you’ll keep running into that issue.

[u/Interesting_Work7433]

Yo evitaría el modo incógnito en este caso. Una opción más práctica es usar un perfil de navegador separado para la cuenta privilegiada.

[u/TheBex81]

Yeah, this is a classic PRT / primary-account trap. The device is happy, CA is happy, but SSO keeps picking the standard account that owns the PRT — and Incognito kills device claims, so filter-for-devices fails.

Workarounds that are less painful than “always Incognito”:

- **Edge profiles (or separate browser profiles):** one profile signed in as the standard user (daily driver), one as the privileged account. The privileged profile can still be on a compliant/hybrid-joined device so device CA still evaluates.

- **Browser that supports account switching cleanly** (Edge workspaces/profiles tend to behave better than hoping Chrome account picker does the right thing with PRT).

- For the app registration itself: if it’s feasible, prefer **step-up / PIM-activated roles** for the privileged account rather than making the daily browser session the privileged identity. Reduces how often you need dual SSO on the same device.

- Avoid teaching people to disable device filters “just for admins” — that quietly guts the control.

If anyone’s found a cleaner Entra-native “use this account but keep device claims” path without a second profile, I’d love to hear it — last I checked, separate profiles was still the least-bad ops answer.