We're a two-person IT team managing about 225 users on Microsoft 365 Business Premium. Our Windows workstations are Entra joined and managed through Intune.
We're moving administrative roles away from our everyday accounts and onto dedicated cloud-only admin accounts. I'm testing phishing-resistant MFA and Conditional Access policies that require a compliant device.
The challenge is making this practical. We regularly switch between Intune, Exchange, Entra, SharePoint, Teams, and other Microsoft portals. I tried using a separate Edge profile for the admin account, but the portals often tried to authenticate with my everyday Windows identity. Using a login hint or manually selecting the correct account works, but I'm still validating the Conditional Access behavior.
I'd rather not connect the admin identity to Windows just to improve browser SSO, and private browsing appears incompatible with requiring a compliant device.
For a small IT team, what setup works best in practice? Do you use separate browser profiles, entirely separate browsers, account switching, or private windows? Do you connect cloud-only admin accounts to Windows? Do you require compliant devices, use privileged identity management, or work from dedicated administrator workstations? I'm looking for a workflow that provides real separation without constantly correcting the account used by each portal.
6 Answers
Private or incognito windows are easy to understand, but they can be a poor fit when Conditional Access requires a compliant device. The private session may not carry the device or primary refresh token claims that Microsoft uses to evaluate compliance, so the policy can fail or repeatedly prompt for authentication. A normal, dedicated browser profile on a managed device is generally more reliable.
A simple approach is to use the normal browser window for daily work and a separate browser or permanent admin profile for privileged work. For example, keep Edge for the everyday account and Firefox or Brave for administration. If using Edge profiles, disable the option that opens external links in another profile, since that can cause unexpected account switching. Some teams also use a separate desktop shortcut that launches the browser directly with the admin profile.
Privileged Identity Management is the cleanest experience when the licensing is available. Keep privileged roles eligible rather than permanently active, then activate only the role needed for a short period with fresh phishing-resistant MFA, justification, and approval where appropriate. Use separate cloud-only emergency accounts as break-glass accounts and test them periodically. If you stay with permanently separate admin accounts, keep Global Administrator access as restricted as possible and use lower-privilege roles for normal work.
PIM requires Entra ID P2, so Microsoft 365 Business Premium by itself does not include it. That licensing cost should be checked before designing the workflow around PIM, especially in a small tenant.
Separate browser profiles or Firefox Multi-Account Containers work well for this. Keep the everyday identity in one profile and the administrative identity in another, with a very obvious theme or color for the admin profile. Containers are especially useful when you manage multiple tenants or need several accounts open at once. They preserve device information better than private browsing while still keeping sessions separated.
We use a dedicated container for each tenant and one for personal accounts. After a little practice, switching between them becomes second nature.
For stronger separation, use a dedicated privileged access workstation or a Cloud PC used only for administration. Keep browsing and unrelated applications off it, require phishing-resistant MFA such as a FIDO2 security key, and apply restrictive Conditional Access policies. This is more effort than separate profiles, but it limits the damage if the everyday workstation or account is compromised.
A separate admin workstation may be excessive for every task, but it makes sense for Global Administrator access and other high-impact operations. Routine delegated administration can usually happen from a managed workstation with strong policies.
A tiered model is a good compromise: use the everyday account for email and normal work, a separate lower-privilege administrative account for routine endpoint and user tasks, and highly protected Global Administrator accounts only for exceptional changes. Require compliant managed devices, short sign-in sessions, strong MFA, and careful role assignment. A management platform such as CIPP can also reduce how often you have to jump between individual Microsoft portals, depending on how much access you grant it.
That matches what we found. We use private windows only for accounts that do not have a device-compliance requirement; the administrative profile is a regular managed browser profile.