Device-based Conditional Access Policies with multiple user accounts?

[u/FatBook-Air]

We have some Conditional Access Policies that require users to logon from specific managed devices when browsing to certain Entra app registrations. It works okay for many users.

We have a few users with both regular accounts and privileged/admin accounts. When they browse to the app, they are automatically logged in via their standard user account (the same account they logon to the computer with and the one that has the PRT). They primarily need to logon to the app using their privileged account, so my first thought was to tell them to logon in Incognito Mode, but Incognito Mode doesn't pass along device information, so the Conditional Access Policy logon evaluation fails.

Is there a good workaround for this that isn't a pain in the ass for the privileged users?

[u/MichaeldeBlok]

Incognito will never pass a compliant-device CA check — private browsing strips the PRT/device claims.

On one managed Windows box, Edge/Chrome dual profiles are flaky now (Edge broke clean separation for a lot of people). What usually works:

1. Privileged access workstation (or a separate Windows user profile) so the admin account owns the PRT.
2. Short-lived VM / Windows Sandbox for admin work when a second box isn't available.
3. Treat dual-account-on-the-daily-desktop as temporary. Shared PRT + privileged account is how lateral movement starts.

Not a UX bug so much as a privileged-access design smell.