diff --git a/client/internal/profilemanager/service.go b/client/internal/profilemanager/service.go
index 019c497cc..956b6f02c 100644
--- a/client/internal/profilemanager/service.go
+++ b/client/internal/profilemanager/service.go
@@ -578,7 +578,7 @@ func readProfileName(path string) string {
 }
 
 // nolint: unused,unusedfunc
-func readProfileOwner(path string) (ipcauth.Identity, error) {
+func ReadProfileOwner(path string) (ipcauth.Identity, error) {
 	data, err := os.ReadFile(path)
 	if err != nil {
 		return ipcauth.Identity{}, err
@@ -603,7 +603,7 @@ func readProfileOwner(path string) (ipcauth.Identity, error) {
 }
 
 // nolint: unused,unusedfunc
-func stampOwner(path string, owner ipcauth.Identity) error {
+func StampOwner(path string, owner ipcauth.Identity) error {
 	data, err := os.ReadFile(path)
 	if err != nil {
 		return err
diff --git a/client/server/server.go b/client/server/server.go
index ab8389ce8..ca8a65bf9 100644
--- a/client/server/server.go
+++ b/client/server/server.go
@@ -148,8 +148,6 @@ type Server struct {
 	loginAttemptFn func(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error)
 
 	isLoginRequiredFn func(ctx context.Context) (bool, error)
-
-	sessionHolder *ipcauth.Identity
 }
 
 type oauthAuthFlow struct {
@@ -1085,14 +1083,6 @@ func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpR
 	s.statusRecorder.UpdateRosenpass(s.config.RosenpassEnabled, s.config.RosenpassPermissive)
 	s.localMetrics.Reconcile(s.config.LocalMetricsEnabled, s.config.LocalMetricsAddress)
 
-	id, ok := ipcauth.CallerIdentity(callerCtx)
-	if !ok {
-		s.mutex.Unlock()
-		return nil, fmt.Errorf("failed to get identity")
-	}
-
-	log.Infof("setting session holder: %d", id.UID)
-	s.sessionHolder = &id
 	s.clientRunning = true
 	s.clientRunningChan = make(chan struct{})
 	s.clientGiveUpChan = make(chan struct{})
@@ -1342,7 +1332,6 @@ func (s *Server) cleanupConnection() error {
 	// explicitly asked for it. MDM restart does NOT go through this
 	// path, so its clientRunning stays true.
 	s.clientRunning = false
-	s.sessionHolder = nil
 
 	// Capture the engine reference before cancelling the context.
 	// After actCancel(), the connectWithRetryRuns goroutine wakes up
@@ -2710,13 +2699,29 @@ func (s *Server) authorizeAndPrepareLogin(callerCtx context.Context, msg *proto.
 	return ctx, activeProf, nil
 }
 
+// SessionHolder returns the Identity that owns the active and connected
+// profile. The boolean indicates if the session is connected and an owner
+// is defined in the config.
 func (s *Server) SessionHolder() (ipcauth.Identity, bool) {
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
-	if !s.clientRunning || s.sessionHolder == nil {
+	activeOwners := s.config.Owners
+
+	if !s.clientRunning || len(activeOwners) < 1 {
 		return ipcauth.Identity{}, false
 	}
-	return *s.sessionHolder, true
+
+	principal, ok := ipcauth.ParsePrincipal(activeOwners[0])
+	if !ok {
+		return ipcauth.Identity{}, false
+	}
+
+	id, err := ipcauth.IdentityFromPrincipal(principal)
+	if err != nil {
+		return ipcauth.Identity{}, false
+	}
+
+	return id, true
 }
 
 func persistLoginOverrides(activeProf *profilemanager.ActiveProfileState, managementURL string, preSharedKey *string) error {