We have Conditional Access policies that require users to sign in from an approved managed device when accessing certain Microsoft Entra applications. This works for most users, but some have both a standard account and a separate privileged administrator account. Their browser automatically uses the standard Windows account, which is also the account associated with the device's primary refresh token (PRT). They need to access the applications with their privileged account instead. Incognito mode seems unsuitable because it does not provide the device identity information required by the policy. Is there a convenient and reliable way for administrators to use their privileged account while still satisfying the device-based Conditional Access requirement?
2 Answers
A separate browser profile is usually the least disruptive option. Create one profile for the standard account and another for the privileged account, then use different colors or profile names so they are easy to distinguish. This keeps the sessions separate without relying on Incognito mode.
This behavior can vary between browser versions. In some newer Edge setups, a separate profile may still try to use the Windows account for Microsoft 365 sign-in, so profiles may not provide complete account isolation.
I would avoid Incognito here. The device check depends on the browser session being able to use the device registration and PRT context, so a private session can fail the Conditional Access evaluation. A dedicated, persistent browser profile for the privileged account is the more practical approach, provided it passes a controlled test.
The important caveat is whether the browser profile still exposes the managed device identity and PRT context. That should be tested against the actual Conditional Access policy rather than assumed.