Privileged access workstations: why admin accounts need a dedicated device

Most serious incidents in Microsoft environments have a turning point: the attacker obtains administrator rights. From then on they can create accounts, disable security features, exfiltrate data or distribute malware across the whole organisation. In the attack on a Polish combined heat and power plant in December 2025, the attackers took over privileged Active Directory accounts and pushed their malware to the machines via Group Policy (CERT Polska, Energy Sector Incident Report).

Many organisations now protect their administrators with MFA. The device those administrators work on, however, is often the same laptop they use to open invoices, read Teams messages and search for error messages. A PAW concept addresses exactly that.

What is a privileged access workstation?

A privileged access workstation is a device used exclusively for administrative tasks. Microsoft describes it as the highest security level for devices and states the reason explicitly: the PAW blocks the most common vectors for phishing, email and web browsing (Microsoft Learn: Privileged access devices).

According to Microsoft, a PAW includes, among other things:

• management through Intune from first boot, no personal devices
• no local administrator rights for the person using it
• applications only from central deployment, secured with application control
• web access restricted to approved destinations such as the admin portals of Microsoft 365 and Azure
• Microsoft Defender for Endpoint, BitLocker and hardware-based protection such as Credential Guard

For mailbox, Teams and research, the person keeps a normal device with their normal account.

Why is MFA not enough for admin accounts?

MFA protects the sign-in, not the device. Three routes still lead to the target:

Fake sign-in pages. In an adversary-in-the-middle attack, the administrator enters password and code on a cloned page that relays both in real time. The attacker receives the signed-in session. Phishing-resistant methods such as passkeys prevent this; see Conditional Access and passkeys.

Malware on the device. An opened attachment or a tampered download is enough for an infostealer to read session tokens and stored credentials from the browser. The sign-in itself was phishing-resistant, yet the session is taken over.

Watching while the administrator works. Whoever controls the device sees what the administrator does and can act on their behalf while they are signed in.

Microsoft summarises this as the clean source principle: the trust level of the source must be the same or higher than that of the destination (Microsoft Learn: Success criteria for privileged access strategy). A Global Administrator working from a device with email and unrestricted internet access breaks that principle.

What belongs in a PAW concept?

The device alone does not protect anything if the admin account also works elsewhere. A complete concept covers five things:

1. Separate admin accounts. Each person has a normal account for daily work and an admin account without a mailbox or Office licence. Admin accounts for Entra ID are cloud-only and are not synchronised from the on-premises Active Directory.
2. Phishing-resistant sign-in. Admin accounts sign in with a FIDO2 security key, a passkey or Windows Hello for Business, enforced through an authentication strength.
3. Time-limited roles. With Privileged Identity Management (PIM), admin roles are only active when needed, with a justification and, if required, an approval.
4. A defined device. Administration happens only on the PAW, physical or virtual.
5. Enforcement. Conditional Access in Entra ID and logon restrictions in Active Directory make sure admin accounts do not work on any other device.

Option 1: the physical PAW

The classic implementation is a dedicated laptop that Windows Autopilot enrols in Intune straight out of the box and hardens according to the PAW profile. The person signs in to it with the admin account; signing in with the normal account is not intended.

The physical PAW offers the highest level of protection, because no less trustworthy device sits between the administrator and the target. It is the benchmark for accounts with access to everything: Global Administrator, domain admins, and administrators of Entra Connect, certificate services and backup.

The price is a second device per person and some discipline in daily work. For a small team with a few tier 0 administrators this is manageable.

Option 2: the PAW in Azure Virtual Desktop

In the virtual variant, the admin workstation runs as a desktop in Azure Virtual Desktop (AVD) or as a Windows 365 Cloud PC. The session host is hardened like a physical PAW: no mailbox, no general browsing, application control, Defender for Endpoint. Admin accounts may sign in only there.

This has concrete advantages. No additional hardware is needed, new administrators and external service providers can be set up quickly, and all admin sessions run through one central, monitored point. Clipboard and drive redirection can be disabled for the admin host pool so that no files from the normal device reach the admin session.

The limit is the clean source principle. The desktop in AVD is only as secure as the device you connect from. If malware runs on the normal laptop, it can capture keystrokes and screen content of the admin session. Microsoft therefore advises against allowing privileged access from devices at the normal enterprise level.

This leads to a pragmatic split:

• For administrators of individual services such as Intune, Exchange Online or Teams, a PAW in AVD that can only be reached from a managed, compliant device with phishing-resistant sign-in is a big step forward compared with the current state in many organisations.
• For tier 0, meaning Global Administrator, domain admins and comparable roles, the device used to connect should itself be hardened. That can be a physical PAW or a reduced device that runs only the AVD client.

Physical or virtual: which option fits?

In practice, many organisations combine both: physical PAWs for the few people with tier 0 rights, AVD for all other admin roles.

How do you enforce use with Conditional Access?

A PAW that can be bypassed will be bypassed. Enforcement in Entra ID consists of two policies for all accounts with admin roles:

• Require phishing-resistant sign-in. The target is the directory roles, and the grant control is the authentication strength “Phishing-resistant MFA”.
• Allow access only from the PAW. Same target group, with the Microsoft admin portals and Azure management as resources. The policy blocks access from all devices that the device filter does not recognise as a PAW, for example through a device attribute carried only by PAWs and AVD session hosts. Microsoft names exactly this use case in the documentation on device filters.

Both policies first run in report-only mode. The sign-in logs then show who still administers from which device today. Emergency access accounts remain excluded and are protected separately with FIDO2 keys. How to introduce policies without locking people out is described in Conditional Access rollout without lockouts.

What applies in on-premises Active Directory?

In Active Directory, the principle is called tiering. Accounts with tier 0 rights, such as domain admins, may sign in only to domain controllers, other tier 0 systems and PAWs, never to normal clients or member servers. Otherwise their credentials remain in the memory of a device that an attacker can reach more easily.

Technically, this is implemented with Group Policy logon restrictions, the “Protected Users” group and authentication policies with silos. The server running Entra Connect also belongs to tier 0, because it synchronises identities between Active Directory and Entra ID. The Active Directory Security Assessment shows how tiering, delegations and service accounts look in your domain.

Which mistakes do we see often?

• The jump server is treated as a PAW. Connecting from the normal laptop via RDP to an admin server only moves the problem.
• Admin accounts have a mailbox and an Office licence, which makes them directly reachable through phishing.
• Exceptions “just for today”. A Conditional Access exclusion for someone who is travelling often stays in place for months.
• Service providers administer from their own devices. The same rules apply to external administrators, and the AVD variant makes this manageable.
• The PAW has an unrestricted browser. Then it is a second everyday device, not a PAW.

In which order should you proceed?

1. Take stock. Who holds which admin role in Entra ID, Azure and Active Directory, and from which devices is administration done today?
2. Separate admin accounts. Dedicated cloud-only accounts without a mailbox, emergency access accounts with FIDO2 keys.
3. Harden sign-in. Phishing-resistant MFA for all admin accounts and admin roles through PIM only on a time-limited basis.
4. PAWs for tier 0. Physical devices for the few people with the highest rights.
5. AVD for further admin roles. Build an admin host pool, including for service providers.
6. Enforce. Review Conditional Access in report-only mode, then switch it on; activate the logon restrictions in Active Directory.

Frequently asked questions

Which licences does a PAW concept require?

Conditional Access with device filters requires Entra ID P1, Privileged Identity Management requires Entra ID P2 or Entra ID Governance. Devices are managed with Intune. For Azure Virtual Desktop, you add Azure compute and an eligible Windows licence, as included in Microsoft 365 E3, E5 or Business Premium. Windows 365 is licensed per user.

Is a PAW worth it for a small IT team?

Especially there. In small teams, two or three people often hold all rights and also do normal office work. Two physical PAWs for the tier 0 accounts are a modest effort compared with the damage a compromised Global Administrator account can cause.

Is a separate admin account without a dedicated device not enough?

The separate account is an important first step, because it cannot be reached by email. If it is used on the same device where the normal account opens email, malware on that device can still take over the admin session.

What do we show the auditor?

The written concept with roles and tiers, the export of the Conditional Access policies, the PIM assignments and extracts from the sign-in logs showing that admin roles are only used from PAWs. Forward the logs to a Log Analytics workspace or Microsoft Sentinel so that they are available for longer than 30 days.

The next step

In the fixed-price Security Assessment we check which accounts hold admin roles, how they sign in and from which devices administration is done. In the penetration test we show how far an attacker with an ordinary account would get towards those rights. We then implement the PAW concept with your IT and either hand it over with documentation or operate it as part of Managed Security.

Book an introductory call