The following is a SharePoint dictionary word of the day: Alternate Account
Alternate Account in SharePoint: Understanding Secondary Identities in the Same Forest
In complex enterprise environments, it is common for users to have more than one Active Directory account. One of these may be designated as an alternate account, allowing organizations to support administrative tasks, migrations, security requirements, and resource access scenarios without creating entirely separate identities.
What Is an Alternate Account?
An alternate account is an additional user account that exists in a different domain but remains within the same Active Directory forest as a user's primary account.
This secondary account is typically linked to the same individual and may be used for:
- Administrative responsibilities
- Elevated privilege access
- Legacy application support
- Resource access across domains
- SharePoint migration scenarios
- Security separation of duties
For example:
User Primary Account Alternate Account
John Smith CORP\jsmith ADMIN\jsmith-admin
Both accounts belong to the same Active Directory forest but reside in different domains.
Why Alternate Accounts Matter in SharePoint
SharePoint environments often integrate closely with Active Directory for authentication and authorization. When organizations operate multiple domains within a single forest, SharePoint can recognize alternate accounts and map them to the same user identity under specific configurations.
Benefits include:
- Administrative Access
- Many organizations require administrators to use separate privileged accounts.
- Instead of granting elevated permissions to a user's everyday account:
- Primary Account: Email, Teams, SharePoint collaboration
- Alternate Account: SharePoint Farm Administration, SQL Administration, Service Management
This helps reduce security risks associated with privilege escalation.
Cross-Domain Resource Access
Large enterprises frequently organize business units into separate domains while maintaining a common forest structure.
Example:
Forest: Contoso.com
Domain A:
user1@corp.contoso.com
Domain B:
user1@admin.contoso.com
SharePoint can authenticate users from both domains while maintaining consistent access control.
Migration and Consolidation Projects
During:
- Domain consolidations
- Active Directory restructures
- Mergers and acquisitions
- SharePoint migrations
Alternate accounts provide continuity while user identities are transitioned between domains.
SharePoint Authentication Considerations
When an alternate account is configured:
User Profile Service
The SharePoint User Profile Service can associate profile information with the correct individual even when multiple domain accounts exist.
Organizations should verify:
- Account mappings
- Profile synchronization settings
- Identity synchronization rules
- Active Directory trust relationships
- Permission Management
Permissions should be assigned carefully.
Best practice is to: Grant permissions through Active Directory security groups
Avoid: Assigning permissions directly to both primary and alternate accounts
Using groups simplifies administration and auditing.
Security Best Practices
Organizations using alternate accounts should follow several security recommendations:
1. Separate Administrative Activities
- Use:
- Primary account for daily work
- Alternate account for administrative functions
- This aligns with Microsoft's least-privilege security model.
2. Enforce Multi-Factor Authentication
- Apply MFA to both:
- Primary identities
- Alternate identities
- Administrative accounts should receive the strongest protection.
3. Enable Auditing
- Monitor:
- SharePoint access
- Permission changes
- Administrative actions
- Login activity across domains
4. Follow Zero Trust Principles
- Treat each account independently:
- Verify identity
- Validate device compliance
- Require conditional access policies
- Common SharePoint Scenarios
Scenario 1: SharePoint Farm Administrator
Primary: CORP\KevinB
Alternate: ADMIN\KevinB-ADM
The user accesses SharePoint sites using their primary account while performing farm administration tasks with the alternate account.
Scenario 2: Domain Migration
Old Domain:
NA\User1
New Domain:
CORP\User1
During migration, SharePoint can maintain access continuity until permissions and profiles are fully updated.
Scenario 3: Multi-Domain Enterprise
Sales.DomainA.com
IT.DomainB.com
HR.DomainC.com
A user's alternate account enables controlled access to resources located within another domain while remaining inside the same forest.
- Benefits of Alternate Accounts in SharePoint
- Improved security through privilege separation
- Easier administration across multiple domains
- Support for migration and consolidation projects
- Better compliance and auditing capabilities
- Flexible resource access within a shared forest
Conclusion
In SharePoint, an alternate account is an additional user account located in a different domain but within the same Active Directory forest as the user's primary account. These accounts are commonly used to separate administrative and standard user activities, facilitate cross-domain access, and support migration scenarios. When managed properly through Active Directory groups, MFA, and least-privilege principles, alternate accounts help organizations improve both security and operational efficiency while maintaining seamless SharePoint access.