I wholeheartedly agree, but as a sysadmin for mutualized clients, at some point in the process i need to interact with a generic elevated accout. Would it be po

I wholeheartedly agree, but as a sysadmin for mutualized clients, at some point in the process i need to interact with a generic elevated accout. Would it be possible to forgo that? Sure, some of our clients have implemented robust password sync through ldap or general federation, but doing that has a cost, and doing that also means that an admins password is now a single point of failure, MFA being unrealistic specifically because those accounts generally have to log in a lot of times. An admins password (not our team) being leaked is exactly what hapened to our client with the most effective federation, and the consequences were disastrous. They have now recovered, but are considering other options and potentially going back to machine-specific passwords to ensure only one gets compromised at a time.