A computer system, comprising: one or more processors; and memory having collectively stored therein instructions that, upon execution by the computer system, cause the computer system to: authenticate a user, utilizing credential information for accessing one or more services provided by a computing resource service provider; receive, from the user, a first request to create an identity pool within a managed directory service provided by the computing resource service provider, the access to the managed directory service based at least in part on the credential information and the identity pool comprising user accounts of one or more users of the managed directory service and directory policies defining, for each of the one or more users, a level of access to a directory within the managed directory service and to applications managed in the directory; after authenticating the user, create the identity pool within the managed directory service and a shadow administrative account usable by the user within the created identity pool, the account usable for managing user profiles of the one or more users and the directory policies for defining the level of access to the directory and to the applications managed in the directory for individual users of the directory; transmit, through the computing resource service provider and to the managed directory service, a second request from the user to obtain a directory token for accessing the shadow administrative account; provide the directory token from the managed directory service; and enable the user to utilize the directory token to perform actions within the directory. one or more processors; and memory having collectively stored therein instructions that, upon execution by the computer system, cause the computer system to: authenticate a user, utilizing credential information for accessing one or more services provided by a computing resource service provider; receive, from the user, a first request to create an identity pool within a managed directory service provided by the computing resource service provider, the access to the managed directory service based at least in part on the credential information and the identity pool comprising user accounts of one or more users of the managed directory service and directory policies defining, for each of the one or more users, a level of access to a directory within the managed directory service and to applications managed in the directory; after authenticating the user, create the identity pool within the managed directory service and a shadow administrative account usable by the user within the created identity pool, the account usable for managing user profiles of the one or more users and the directory policies for defining the level of access to the directory and to the applications managed in the directory for individual users of the directory; transmit, through the computing resource service provider and to the managed directory service, a second request from the user to obtain a directory token for accessing the shadow administrative account; provide the directory token from the managed directory service; and enable the user to utilize the directory token to perform actions within the directory. authenticate a user, utilizing credential information for accessing one or more services provided by a computing resource service provider; receive, from the user, a first request to create an identity pool within a managed directory service provided by the computing resource service provider, the access to the managed directory service based at least in part on the credential information and the identity pool comprising user accounts of one or more users of the managed directory service and directory policies defining, for each of the one or more users, a level of access to a directory within the managed directory service and to applications managed in the directory; after authenticating the user, create the identity pool within the managed directory service and a shadow administrative account usable by the user within the created identity pool, the account usable for managing user profiles of the one or more users and the directory policies for defining the level of access to the directory and to the applications managed in the directory for individual users of the directory; transmit, through the computing resource service provider and to the managed directory service, a second request from the user to obtain a directory token for accessing the shadow administrative account; provide the directory token from the managed directory service; and enable the user to utilize the directory token to perform actions within the directory.