We're a two-person IT team supporting about 225 users on Microsoft 365 Business Premium. Our Windows workstations are Entra joined and managed with Intune. We're moving administrative roles off our everyday accounts and onto dedicated cloud-only admin identities, with phishing-resistant MFA and a compliant-device requirement under consideration.
The challenge is making this practical. We regularly move between Intune, Exchange, Entra, SharePoint, Teams, and other admin portals. I've tried using a separate Edge profile for the admin account, but some portals initially authenticate with my normal Windows identity. Selecting the correct account or using a login hint works, but I'm still testing the Conditional Access behavior.
I'd rather not add the admin identity as another Windows-connected account just to make browser SSO work. Private browsing seems less suitable because it may not provide the device-compliance claim required by Conditional Access.
For a small IT team, what setup works best in practice? Do you use separate browser profiles, separate browsers, account switching, or private windows? Do you connect admin identities to Windows, require compliant devices, use privileged workstations, or rely on PIM? I'm looking for a workflow that provides good separation without constantly correcting the signed-in account or opening private windows.
3 Answers
PIM is usually the cleanest workflow because the regular identity can request just-in-time access for only the roles needed and for a limited duration. Requiring strong reauthentication when activating a role is better than leaving powerful permissions active all day. The catch is licensing: Microsoft Entra ID P2 is generally required for PIM, while Microsoft 365 Business Premium includes Entra ID P1. You should confirm the exact licensing terms with your licensing provider before assuming that a small number of P2 licenses covers every user who will activate or use the feature.
If PIM isn’t practical, separate cloud-only admin accounts, compliant managed devices, phishing-resistant MFA, short sessions, and clearly separated browser profiles are a reasonable small-team design. A management platform such as CIPP may also reduce how often you need to jump between individual Microsoft admin portals, depending on the access scope and features you enable.
The simplest approach is to keep the everyday account in the normal browser and use a separate browser profile or browser for the admin identity. A private window also works for some organizations, but it can conflict with Conditional Access policies that require a compliant-device claim, so it shouldn’t be treated as equivalent to a properly configured admin profile. Use clear visual indicators, such as a different theme or color, to reduce the chance of making changes with the wrong identity.
Firefox Multi-Account Containers are a very good fit for this. You can keep separate containers for each tenant or identity, and switching between them becomes fairly natural. Edge profiles can work too, but make sure settings such as opening external links in another profile and automatic Windows-account sign-in aren’t causing unexpected account switching. Some teams also use a permanently separate browser, such as Edge for normal work and Firefox or Brave for administration.
That sounds more sustainable than repeatedly opening private windows. I’ll test containers and the Edge profile settings before changing the Windows account configuration.
The compliant-device requirement is exactly why I’m hesitant to depend on InPrivate. A clearly marked admin profile may be the better compromise.