Privileged Access Workstation (PAW) Design

A Privileged Access Workstation (PAW) is a hardened, dedicated device used only for privileged tasks - isolating sensitive accounts from browsing, email, and arbitrary apps. PAWs are the device pillar of Microsoft's privileged access strategy and the enforcement point for the clean source principle.

When to use

Protecting administrators of high-value systems (Entra control plane, Azure root, domain controllers, identity infrastructure - "Tier 0") from credential theft, browser exploit, and supply-chain attack. Use this skill to choose the device tier, harden the build, and enforce PAW-only access via CA.

Do not use this skill for general endpoint hardening (defender-for-endpoint) or device compliance baseline (intune-device-mgmt).

Pick the device profile by admin tier