I am not here to discuss if this document in any parts adhere to all principles and best practices of a secure administration environment, I just want to show a feature as a proof of concept.

Obtain above with a sort of simplicity and costs control.

Connect to Domain Controller thorough RDP form the PAW using SSO (Single Sign On).

Same credential can be used on prem and in cloud (if needed).

Have only one identity with one strong credential.

Have the ability to use multiple PAWs (privileged access workstation) with same MFA credential.

Eradicate from the domain the password presence for those privileged accounts (make impossible to use a password to log on to domain to prevent some king of password attacks).

Use that solution to protect privileged accounts passwords.

Configure a modern MFA solution to access on prem Windows 10 PC.

Meanwhile, you can add whatever online accounts you want by repeating the non-Microsoft account steps on all of your other accounts.I am here just to demonstrate that today is technically possible (Proof of Concept): The Microsoft account setup is something you should only have to do a single time. Give your account a name first to know which one it is, and enter the code beneath it. Go back into the app and tap the Or Enter Code Manually option at the bottom of the page.

Alternatively, the site may give you a code to enter instead of a QR code.

Use the Microsoft Authenticator app to scan the QR code.

You will either see a QR code on your screen or a six-digit code.

Return to the website where it should ask you if you want two-factor authentication via text and email or with an application.

Select the Other account option and prepare to follow the below steps. You can prepare the Microsoft Authenticator app for the task by tapping the three-dot menu button in the Microsoft Authenticator app and selecting the Add account option. This varies from website to website, but the general idea remains the same.

Microsoft account authenticator setup