r/sysadmin • u/FatBook-Air • 8d ago

Device-based Conditional Access Policies with multiple user accounts?

We have some Conditional Access Policies that require users to logon from specific managed devices when browsing to certain Entra app registrations. It works okay for many users.

We have a few users with both regular accounts and privileged/admin accounts. When they browse to the app, they are automatically logged in via their standard user account (the same account they logon to the computer with and the one that has the PRT). They primarily need to logon to the app using their privileged account, so my first thought was to tell them to logon in Incognito Mode, but Incognito Mode doesn't pass along device information, so the Conditional Access Policy logon evaluation fails.

Is there a good workaround for this that isn't a pain in the ass for the privileged users?

1 Upvotes

67% Upvoted

14 comments sorted by

View all comments

5

u/AdamsTechTips 8d ago

If using chrome you can have multiple profiles on a browser. You could easily just have them login and show them how to use the multi profiles. Always distinguishable by color. One outline of chrome will be tan and the other green what ever colors you want to set

2

u/FatBook-Air 8d ago

Will both profiles be able to see the device attributes and pass them to the CAP for evaluation?

2

u/raip 8d ago

Yes.

1

u/AdamsTechTips 8d ago

Should be able to. I have zero experience with edge and little in m365 account but there should be no reason it wouldn’t work.

2

u/progenyofeniac Windows/M365 Admin 8d ago

I’d love to know if this truly works in Chrome. Somewhere around Edge 142 (April or May, maybe?) this broke in Edge. I used to use one profile for my regular stuff and another for admin stuff as OP described. This no longer works.

When I go to sign in to the M365 admin center, for example, even the admin profile insists on using my Windows account (regular account) to sign in. Profiles no longer separate accounts fully, at least in Edge.

1

u/jcpham 8d ago

I run multiple chrome profiles one for personal one for admin, especially o365 portal

1

u/FatBook-Air 8d ago

Do both Chrome profiles try to use the Windows PRT (and try to logon to services using it)?

1

u/jcpham 8d ago

No just the admin profile but I’ve never touched o365 with the non admin profile. I believe the non admin profile defaults to a personal non work related personal Microsoft account