PA-02: Use Dedicated Admin Accounts

PA-02 is a security control that when an attacker compromises a daily work account through phishing or malware, they should not gain admin access. dedicated admin accounts limit blast radius and enable stricter controls like device requirements. It requires that administrative roles are assigned to dedicated admin accounts (e.g., admin-john@contoso.com) and daily work accounts do not hold privileged role assignments, admin accounts are cloud-only (not synced from on-premises ad).

When an attacker compromises a daily work account through phishing or malware, they should not gain admin access. Dedicated admin accounts limit blast radius and enable stricter controls like device requirements.

PA-02 requires manual implementation. Requires organizational process change

This control can be implemented with any Microsoft 365 subscription, including free Azure AD.

PA-02 is included in the TrueConfig Recommended Secure baseline (Level 1). This is the foundation level suitable for most organizations.