What is considered best practice when initially provisioning users in Intune?

Creating a second tenant account during the initial provisioning of users in Intune is a best practice because it helps to segregate administrative roles and responsibilities effectively. By having a separate account dedicated to administrative tasks, you reduce the risk of accidental changes or errors that could impact the main tenant or disrupt user services. This approach enhances security by limiting the number of users with access to sensitive administrative functions and provides an audit trail by keeping administrative actions distinct from regular user activities.

Additionally, segregating administrative duties through a separate account helps ensure compliance with security policies and standards, making it easier to manage permissions and maintain control over user access and configurations. This practice aligns with the principle of least privilege, where users are granted the minimum level of access necessary to perform their roles.

While using the default admin account for all user setups, granting administrative privileges to all users, or establishing a user feedback session may appear reasonable, they do not align with best practices centered around security, risk management, and controlled access within an enterprise setting.