Account separation is one of the harder CE+ requirements to get right. Admin By Request EPM passes it when set up with Run As Admin, approval, and MFA in place.