How do you separate daily and admin accounts for security?

My approach is pretty strict. I don’t let my daily user account have any special access, which can be a pain sometimes because it limits me from accessing some basic internal documents. I use a separate PC just for admin tasks that’s on a management VLAN and secured with MFA.

For managing multiple Azure tenants, I’ve switched to using different profiles in Edge, which works great. It’s a lot simpler than using different browsers, especially since I can handle multiple admin accounts without much hassle.

Yeah, it's really straightforward to keep things separate. For daily tasks, you shouldn’t have any admin privileges at all. If you need to log in as an admin, just open a browser or tool as that user specifically.

I really recommend keeping separate accounts. It’s just standard practice now. I’ve been doing this for over 25 years, and while it felt annoying at first, it’s second nature now. Using tools like sudo or runas isn’t hard either. It's especially important for teams that need to log into production servers; at least you can audit what’s done and by whom.

One good practice is to run your daily and admin tasks on completely different VMs. Even if your daily VM gets compromised, it can help safeguard your admin activities on a separate one. Some might find it a bit over the top, but it's a solid way to add layers of security.