DEV-122 - Require SAW for Admin Actions

Implementation Effort: High – Requires procuring and provisioning dedicated Secure Admin Workstations, defining Conditional Access policies, and changing admin workflows.

User Impact: Medium – Administrators must perform all privileged actions from a designated SAW device, changing their daily workflow.

Overview

A Secure Admin Workstation (SAW), also known as a Privileged Access Workstation (PAW), is a hardened device dedicated exclusively to performing administrative tasks. By requiring all privileged actions to originate from a SAW, organizations create a clean-source environment that significantly reduces the risk of credential theft, malware injection, and lateral movement from compromised general-purpose workstations.

This supports Verify explicitly by ensuring that admin sessions originate from a trusted, hardened device with known security posture. It supports Assume breach by isolating privileged operations from everyday browsing, email, and productivity activities where compromise is most likely. Without SAW enforcement, a compromised admin workstation gives attackers direct access to management planes.

Key Configuration Steps

1. Provision dedicated SAW devices with hardened Windows configuration and restricted internet access
2. Enrol SAW devices in Intune with a strict compliance policy (BitLocker, EDR, restricted apps)
3. Create a device filter or group for SAW devices in Microsoft Entra
4. Configure Conditional Access policies requiring admin portal access only from compliant SAW devices
5. Block admin portal access from non-SAW devices using named locations or device filters
6. Train administrators on the SAW workflow and provide clear escalation paths for emergencies

Reference

• Securing devices as part of the privileged access story
• Privileged access deployment