Microsoft’s privileged-access guidance says that protecting roles and accounts is not enough. The device, administrative interface, and any intermediary—such as a jump server, VPN, or virtual desktop—form part of the end-to-end privileged session. If an attacker controls the originating device, the attacker may impersonate the administrator during the session or steal credentials and tokens for later use.
\n\nMicrosoft defines a Privileged Access Workstation (PAW) as a dedicated, hardened device used only for administrative tasks. It is separate from ordinary user devices and restricts general browsing and productivity activity. The objective is to prevent privileged credentials and actions from being exposed to an untrusted environment.
\n\nThe current Microsoft model describes privileged access as explicitly controlled, isolated from normal activity, continuously monitored, and assumed to be a primary target. Recommended safeguards include strong authentication, managed and compliant devices, time-bound elevation, device hardening, restricted connectivity, and monitoring of identity and endpoint behavior.
\n\nStrong multifactor authentication is essential, but it proves only the factors and conditions evaluated by the authentication system. Malware controlling the workstation may still capture a session, abuse an already-authorized browser, alter an administrator’s intended command, or wait until privilege is activated. A separate trusted administrative device reduces the opportunity for email attachments, arbitrary websites, consumer software, and ordinary user activity to share the same execution environment as high-impact administration.
\n\nCreate an inventory of roles and interfaces capable of changing identity, security policy, code, backups, network traffic, or business-critical systems. Include Global and Domain Administrators, hypervisor and backup administrators, firewall and switching control, RMM platforms, certificate authorities, password and secret stores, security-management consoles, domain registrars, video-management systems, and access-control administration.
\n\nClassify each role by potential impact rather than job title. A technician with authority to deploy software to every endpoint may present more organizational risk than a conventional server administrator. Document the approved device, account, interface, elevation method, and monitoring source for every privileged path.
\n\nA jump server does not automatically create a trusted path. It must be managed, monitored, patched, and restricted to at least the assurance required by the target system. Clipboard transfer, drive mapping, downloads, browser use, and outbound connectivity should be allowed only when required. Administrative connections should terminate at named systems through approved protocols rather than opening broad network access.
\n\nApply the same principle to vendor support. A third party should not enter the privileged plane through a shared VPN account or an unmanaged technician laptop. Use individually attributable identities, approved access devices or controlled intermediaries, limited destinations, time bounds, and recorded approval.
\n\nAlert on privileged sign-ins from unapproved devices, unexpected role activation, security-policy changes, disabled monitoring, new local administrators, and attempts to use administrative accounts for email or general applications. Review PAW compliance and administrative group membership regularly.
\n\nTest replacement, recovery, and emergency access before a device failure or tenant lockout. A PAW program is complete only when administrators can perform necessary work, emergency paths remain available, and high-impact credentials no longer appear on ordinary endpoints.
\n\n