How-To: Configure Alternative Admin Accounts in Keytos Shield

Learn how to set up alternative accounts in Keytos Shield so administrators can use phishing-resistant credentials for both their everyday and admin accounts on one security key.

Overview - What are Alternative Accounts in Keytos Shield?

Many organizations give administrators a second account, such as adm_jsmith@contoso.com, to keep privileged access separate from everyday work. In Keytos Shield, these are called alternative accounts. Instead of treating them as unrelated users, Shield links each alternative account to the user’s primary account by a naming pattern, so administrators can get phishing-resistant credentials for both accounts.

You can add as many alternative account patterns as you need, for example one for domain admins and another for break-glass accounts.

Prerequisites for Configuring Alternative Accounts

  1. You have completed Keytos Shield identity security onboarding.
  2. You have the Owner or Identity Administrator role on your Keytos Shield subscription.
  3. The domains your primary and alternative accounts use are allowed to onboard with Shield.

Step-by-Step Guide - How to Add an Alternative Account in Keytos Shield

Step 1 - How to Open the Alternative Account Settings

  1. Open the Keytos Shield global portal in your browser (US Government Portal) and open your region-specific Shield endpoint under Existing subscriptions.

  2. From the left-hand menu, expand Identity security and click Identity settings.

  3. Click Alternative accounts.

    Keytos Shield Identity settings page listing Domain, Enrollment and recovery, Smart cards, Certificates, and Alternative accounts with Identity settings highlighted in the left-hand menu

Step 2 - How to Configure a New Alternative Account

  1. Under New alternative account, enter an Account nickname that describes this group of accounts, for example “Domain admins”.

  2. For Account prefix, select Prefix or Suffix, and enter the text your alternative accounts add to the user’s name:

    • Prefix: Added before the user’s name, for example adm_ in adm_jsmith.
    • Suffix: Added after the user’s name, for example -admin in jsmith-admin.

  3. For Primary account domain, select the domain of the user’s primary account, for example contoso.com in jsmith@contoso.com.

  4. For Alternative account domain, select the domain of the alternative account, for example contoso.onmicrosoft.com in adm_jsmith@contoso.onmicrosoft.com.

  5. Under Allowed bootstrapping credentials, keep Existing Entra ID credential checked.

  6. Choose which account can set up credentials for the other. The description under each option shows an example using your prefix and domains.

    • Allow alternative account to create primary account credentials: Select Yes to let a user signed in with their alternative account onboard their primary account.
    • Allow primary account to create alternative account credentials: Select Yes to let a user signed in with their primary account onboard their alternative account.

  7. Under Credentials for alternative account, choose which credentials Shield creates for the alternative account: Smart card (CBA), Passkey (FIDO2), or both.

  8. Click Add alternative account.

    Keytos Shield new alternative account form with nickname Domain admins, prefix adm_, contoso.onmicrosoft.com domains, and Add alternative account highlighted

  9. Click Save changes at the top right of the page.

Done! Users who have an account matching this pattern can now set up phishing-resistant credentials for both of their accounts.