CA-06: Restrict Admin Access to Privileged Access Workstations

CA-06 is a security control that privileged access workstations (paws) are hardened devices dedicated to admin tasks. by restricting admin portals to paws, you prevent credential theft from compromised daily-use devices. It requires that administrative portal access is restricted to designated paw devices and paw devices have enhanced security controls (credential guard, applocker), break-glass procedures exist for paw unavailability.

Privileged Access Workstations (PAWs) are hardened devices dedicated to admin tasks. By restricting admin portals to PAWs, you prevent credential theft from compromised daily-use devices.

CA-06 requires manual implementation. Requires dedicated PAW infrastructure and device filters

This control requires Azure AD Premium P2 (included in Microsoft 365 E5) or standalone P2.

CA-06 is included in the Maximum Security baseline (Level 3). This level is designed for high-security environments and regulated industries.