❓ Frequently Asked Questions
❓ Why Do We Need a Super Admin Account?
🎯 The Short Answer
You need a Super Admin account (using an onmicrosoft.com email) to:
✅ Federate your domain with IDEE
✅ Maintain emergency access if something goes wrong
✅ Avoid being locked out of your own tenant
🧩 Why Can’t We Use a Regular Domain Account?
Issue | Explanation |
|---|---|
🔒 Lockout Risk | If you federate your domain and all admins use accounts within that domain, a misconfiguration could lock everyone out — including you! |
🚫 Federation Limitation | You cannot federate an onmicrosoft.com domain. That’s a good thing! It stays managed by Microsoft and always works as a fallback. |
🆘 Break Glass Account | The onmicrosoft admin account acts as your “break glass” account. In an emergency, you can use it to switch your domain back from federated to managed and regain control. |
👥 Important Note About Admin Access
Every admin has their own separate integration portal experience.
Example:
admin1@domain.com creates an integration in the AuthN Portal.
admin2@domain.com logs in — but cannot see or manage that integration.
🔹 To give admin2 access, admin1 must share the integration using the portal's sharing feature.
🔹 This ensures secure, role-based access to integrations.