Skip to content

Privileged Access Workstations

Tier 0 changes are applied by a person, from their own device, under a PIM-elevated session (Lane A). That device is part of the control plane. If it is also used for email and browsing, one phishing link or malicious download can take over a Global Administrator session. A Privileged Access Workstation (PAW) is a device, physical or virtual, kept only for privileged work.

Status: known gap

No PAW model is defined. Tier 0 applies may be run from everyday devices. This is recorded as GAP-004 in the Exceptions Register.

Why it matters

Microsoft's privileged access security levels say that Privileged-level (Tier 0) accounts must never share a device with productivity work. The platform already removes standing privilege: PIM activation is time-limited, approved and audited. But while a role is active, whatever controls the device controls the session. PIM limits when privilege exists. A PAW limits where it can be used.

Options

Option How it works Strengths Weaknesses
Dedicated physical device A separate, hardened laptop managed by Intune, used only for privileged work The strongest isolation. Microsoft's reference model. Cost, and carrying two devices
Windows 365 Cloud PC for privileged use A cloud PC, hardened and used only for admin work, reached from the everyday device No extra hardware. Central management. The everyday device still reaches the cloud PC's session, so harden it and require compliance
Azure Virtual Desktop jump host A shared, locked-down session host for admin work Central and auditable More to run. Shared hosts need careful session isolation.
Hardened browser profile on the everyday device A separate browser profile used only for admin work Cheapest Weak isolation. The device is still shared. It reduces risk but is not a PAW.

Recommendation: use a Windows 365 Cloud PC for each Tier 0 engineer as the realistic first step. Plan to move to dedicated devices if the platform grows or regulation requires it.

Enforcing it

A PAW only helps if Tier 0 access is only possible from it:

  1. Mark PAWs as compliant devices in Intune, with a device filter or group.
  2. Conditional Access: require a compliant PAW for Tier 0 roles and for Azure management. This extends CA012 ("admin roles require a compliant device"), which is currently off because it needs Intune.
  3. Check it in preflight: preflight.ps1 can refuse to run unless the session comes from a PAW.

Hardening baseline

  • The Microsoft security baseline for Windows, applied through Intune.
  • No email, no general browsing and no productivity apps.
  • Application control (WDAC or App Control for Business), allowing only the admin tooling: Azure CLI, PowerShell, Terraform, Git and a browser.
  • Phishing-resistant sign-in only (FIDO2 or Windows Hello for Business), which matches CA009.
  • Disk encryption, a firewall, and Defender for Endpoint.