メインコンテンツへスキップ

DEV-122 - Require SAW for Admin Actions

Implementation Effort: High – Requires device standards, Conditional Access, privileged workflow changes, and exception handling.

User Impact: Medium – Privileged staff must use designated hardened devices for sensitive admin work.

Overview​

A secure admin workstation or privileged access workstation is a hardened device dedicated to administrative activity. The control reduces the risk that web browsing, email, consumer applications, or local malware on a normal workstation can compromise high-value credentials or management sessions. In Zero Trust, requiring privileged actions from a trusted admin device creates a cleaner source for control-plane access and helps protect the device management fabric itself.

Implementation Guidance​

  1. Define what counts as a privileged action in your environment, such as Intune policy changes, script deployment, RBAC updates, and connector administration.
  2. Build a hardened admin device baseline with modern patching, full-disk encryption, endpoint detection and response, local admin restrictions, and minimized software footprint.
  3. Register those devices in a clearly governed Microsoft Entra group or device filter so Conditional Access can distinguish approved admin devices from normal productivity endpoints.
  4. Create Conditional Access policies for administrative portals and privileged roles that require compliant approved admin devices and strong authentication.
  5. Use separate accounts for privileged and non-privileged activity. Even on a secure admin workstation, do not blur day-to-day user actions with privileged administration.
  6. Document break-glass and outage procedures so business continuity is preserved without turning exceptions into permanent bypasses.

Reference​