What's the recommendation for an organisation with admins who administer multiple environments?
For example, we have the same administrator with privileged access to different Microsoft Entra Id tenancies - tenantA, tenantB and tenantC. Currently, a single admin has multiple accounts, one for each environment, the only advantage of this is that a compromised account won't impact the other environments, however:
- it does mean a management overhead of multiple accounts and multiple passwords which is a slight pain to manage
- it also leads to a user management issue where we have multiple admin accounts, it's not easy to de-provision accounts as it requires manual intervention in each tenancy and accounts often get forgotten.
I'm thinking of using a single account that has federated authentication to each tenant. The account will be controlled centrally from our main tenant. Is this a security risk? What's best practice?
Are there any NIST recommendations or similar around this?