CA-06Advanced
How to Fix: Restrict Admin Access to Privileged Access Workstations
Step-by-step guide to implement restrict admin access to privileged access workstations in your Microsoft 365 environment.
20-30 minutes
Estimated Time
4
Steps
high
Severity
Maximum Security
Baseline Level
Why This Matters
Privileged Access Workstations (PAWs) are hardened devices dedicated to admin tasks. By restricting admin portals to PAWs, you prevent credential theft from compromised daily-use devices.
Prerequisites
- 1Global Administrator or appropriate admin role in Microsoft Entra ID
- 2Access to Microsoft Entra admin center (entra.microsoft.com)
- 3Microsoft Entra ID P2 license
- 4Conditional Access Administrator role (minimum)
Expected Configuration
- Administrative portal access is restricted to designated PAW devices
- PAW devices have enhanced security controls (Credential Guard, AppLocker)
- Break-glass procedures exist for PAW unavailability
Remediation Steps
1
Review Existing Policies
Examine your current Conditional Access policies.
- •Navigate to Microsoft Entra admin center
- •Go to Protection > Conditional Access
- •Review existing policies and their configurations
2
Design Policy Configuration
Plan the Conditional Access policy that addresses this control.
- •Define target users and groups
- •Determine target applications
- •Plan grant and session controls
3
Create or Update Policy
Implement the Conditional Access policy.
- •Create new policy or modify existing one
- •Configure assignments (users, apps, conditions)
- •Set appropriate grant and session controls
- •Start in Report-only mode for testing
4
Test and Enable
Validate the policy works correctly before full enforcement.
- •Monitor Report-only results
- •Test with pilot group
- •Switch to On when confident
- •Run TrueConfig scan to verify compliance
Related Resources
Automate Your Security Configuration
TrueConfig continuously monitors your Microsoft 365 environment and can automatically fix configuration drift. Start your free trial today.
Start Free Trial