I manage the network for a school district where teachers use both a school email account and a separate county account. Most tasks require the school account, while certain applications and websites require the county account. Edge and Chrome automatically use whichever account is already signed in, which can cause authentication failures or lock users out of the services they need. Is there a Group Policy or similar setting that would prevent automatic sign-in and require users to choose or enter the appropriate account each time?
2 Answers
Long term, the accounts and applications should ideally be integrated so users have one identity or can use guest or cross-organization access for the county applications. Conditional Access and shorter session limits may help control which account is used, but they will not be as straightforward for users as fixing the identity setup or separating the browser profiles.
If you specifically want to stop browsers from using the currently signed-in work account, disable the browser setting that automatically signs users into websites with their current school or work account. In Edge, this can be managed through the browser sign-in settings in Group Policy. Chrome has comparable enterprise policies, though its administrative templates may need to be added before you can deploy them.
I would test this carefully before disabling it everywhere. Turning off SSO can create extra prompts and a lot of user frustration, so limiting it to the affected sites or using a separate profile is often safer.