I had a Microsoft account from a long time back: me@company.com
Years later the company decides to adopt the whole office365 thing and so company.com is now 'managed' by MSFT for email, etc .... so I have a me@company.com 'company' account as well as the 'personal' one.
I'm sure there are a lot of complicated edge cases around all of this which make moving forward really tough for MSFT without breaking things, but the current status quo is confusing and very user hostile.
But in my experience even though I have 5x as many Google accounts as Microsoft ones (across several organizations and institutions) I spend almost no time confused on whether I'm logging into an account that I created, was created for me, was merged with another account, or is an institutional account that was created with a personal email.
I use a password manager for all of them. The only difference I can think of is the UX flow on Microsoft's sign-in page.
Do they know that doesn’t work?
If you do a run-as then you are as vulnerable to PTH as you would be if you just logged in with the admin account anyway... you need to go full PAW these days.
- cut off from general purpose Internet etc.,
- a non-mobile device,
- etc....
See for instance Microsoft's documentation: https://docs.microsoft.com/en-us/windows-server/identity/sec...
For PAW see https://docs.microsoft.com/en-us/windows-server/identity/sec... conceptually I like to explain it as a client-side bastion host