Windows Active Directory Least Privilege - Am I being paranoid ?

I'm working on a solution to secure workstation admins accounts. Here's what I've come up with so far:

We'll have three types of accounts:

1. A standard 'everyday' user account.
2. A privileged domain account with access to consoles such as SCCM and Intune.
3. A non-privileged domain account that will serve as a local admin on user machines.

Both the privileged and non-privileged domain accounts will be placed in the 'Protected Users' group to safeguard against credential theft.

For …

access account accounts active directory cybersecurity directory domain far intune least privilege non privilege privileged sccm solution standard types windows working workstation