I manage the network for a school district where teachers use both a school email account and a separate county account. Most tasks use the school account, while certain applications and websites require the county account. Edge and Chrome frequently use whichever account is already signed in, which can cause users to be locked out or sent to the wrong service. Is there a Group Policy or similar setting that can disable automatic sign-in and require users to choose or enter the appropriate account each time?
3 Answers
If the district controls both identity systems, integrating them would provide a much better user experience. Depending on the applications, guest or business-to-business access, conditional access, or shorter session limits may also help prevent the wrong account from being reused. Browser profiles are still likely to be the quickest practical fix.
Incognito or InPrivate windows can work for the less frequently used account because they do not retain the same browsing session. Users will need to authenticate again, though, so this is more of a workaround than a long-term solution.
For Edge, look under User Configuration > Administrative Templates > Microsoft Edge > Browser Sign-in Settings. The setting that controls automatic sign-in with the current work or school account can be disabled through policy. Chrome has comparable enterprise policies, although you may need to install Google's administrative templates first. Be aware that disabling this globally can create extra prompts and frustration, so applying it only where necessary is preferable.
A separate profile with automatic sign-in disabled just for the affected sites is probably a better compromise than turning it off for every website.