The least followed item on this list is the separate login, and it is the one that actually contains the damage. Everybody connects the agent to their own account because it takes one click, and then its ceiling is your ceiling.
A service account with access to one drive folder turns a bad afternoon into a shrug. It is twenty minutes of setup that nobody does because the alternative works immediately.