We have Conditional Access policies that require users to sign in from specific managed devices when accessing certain Microsoft Entra applications. This works for most users, but some administrators have both a standard account and a separate privileged account. Their browser automatically signs in with the standard Windows account—the one associated with the device's primary refresh token—while they need to access the application as the privileged account. Incognito mode seems unsuitable because it does not carry the device identity needed for the Conditional Access evaluation. Is there a convenient way for administrators to use their privileged accounts without losing the managed-device signal?
2 Answers
Instead of using an incognito window, create a separate browser profile for the privileged account. The profiles can have different names and colors, making it easy to tell them apart, while still using a normal browser session that can provide the device context.
This can depend on the browser and version. Separate profiles used to keep the accounts fairly isolated, but newer browser behavior may still try to use the Windows account for Microsoft 365 sign-in. It is worth testing with the exact browser build and application involved.
I would avoid incognito mode here. The device requirement depends on the browser session retaining the device identity and primary refresh token context, so a private session can cause the Conditional Access check to fail. A dedicated, persistent browser profile is the more practical option, assuming the browser handles account separation correctly.
Would a separate profile actually pass the device attributes and satisfy the Conditional Access policy, or does it still automatically use the standard Windows account?