Blog
Privileged access workstations: deploying PAW for Windows 365 and AVD admins
Deploy privileged access workstations for Azure Virtual Desktop and Windows 365 admins with Conditional Access and PIM.
Table of Contents
- Why identity controls alone cannot protect admin credentials
- PAW vs. jump server vs. Azure Bastion
- Three deployment models for cloud desktop admins
- Configuring Conditional Access and PIM for enforcement
- Compliance framework alignment
- How Nerdio Manager supports PAW governance
- What to get right before you enforce PAW policies
- Keep privileged sessions off everyday endpoints
- Frequently asked questions about privileged access workstations
Your Azure Virtual Desktop admin account has Global Administrator privileges. Your team accesses the Azure portal, Entra admin center, and Microsoft Intune admin center from the same laptops they use for email, Slack, and browsing Stack Overflow. If one of those laptops gets compromised, the attacker inherits every privilege that admin account carries.
Identity controls alone cannot protect admin credentials. The security of the device that originates an admin session sets the ceiling for every Conditional Access policy and MFA requirement layered above it, and a privileged access workstation (PAW) is what raises that ceiling.
This guide is for Windows 365 and Azure Virtual Desktop platform owners, GRC leads, and CISOs. The sections below cover PAW deployment models, enforcement configuration, and where Microsoft Intune and Nerdio Manager for Enterprise fit into ongoing governance.
Why identity controls alone cannot protect admin credentials
Device security sets the upper bound of trust for every identity control layered above it. Conditional Access policies, Microsoft Intune compliance checks, and phishing-resistant MFA all operate within the ceiling the originating device establishes. If the device is compromised, the controls inside Windows 365 and Azure Virtual Desktop cannot compensate. A privileged access workstation is what raises that ceiling.
What a privileged access workstation is
A privileged access workstation is a hardened, locked-down device dedicated to sensitive administrative tasks. It blocks email, general web browsing, and productivity applications to eliminate the most common attack vectors for credential theft. Microsoft's PAW documentation defines a PAW as the highest security device profile in the Enterprise Access Model, reserved for roles where compromise would have significant or material impact on the organization.
What the credential-theft data shows
Attackers are increasingly using valid credentials rather than deploying malware, which puts the device that holds those credentials at the center of the threat model. The Verizon DBIR found that stolen credentials were the initial vector in 22% of breaches. The CrowdStrike report found that 82% of detections in 2025 were malware-free. Average breakout time from initial access to lateral movement dropped to 29 minutes in 2025, with the fastest observed at 27 seconds, according to CrowdStrike findings.
The Verizon DBIR also found that 46% of systems (containing possible corporate credentials) compromised with an infostealer were non-managed devices. Corporate admin credentials on unmanaged machines sit outside every security control you have configured. The same exposure applies to your Windows 365 security posture and Azure Virtual Desktop security configuration.
Microsoft states this directly in its success criteria: "Some PIM/PAM vendors may advocate that their solutions can mitigate device risk from lower-level devices, but we respectfully disagree with those assertions based on our experience investigating incidents." Identity controls operate within the ceiling the device sets.
PAW vs. jump server vs. Azure Bastion
These terms often get used interchangeably, but they secure different layers of the architecture:
- PAW: Secures the endpoint from which an administrator works. The hardened device that originates the admin session.
- Jump server (bastion host): Secures the network path to managed resources. Acts as a controlled intermediary between the admin's device and the target system.
- Azure Bastion: Microsoft's managed PaaS version of a jump server, brokering RDP and SSH connections over TLS without exposing public IPs on target VMs. Microsoft's intermediaries documentation classifies Azure Bastion explicitly as an intermediary (not a PAW replacement).
The architectural distinction matters because these controls stack rather than substitute. Think of it as defense in depth with distinct layers. An admin connects from a PAW (secured endpoint), through Azure Bastion (secured network path), to an Azure Virtual Desktop session host or Cloud PC (managed resource). Removing any layer degrades the overall security posture.
Three deployment models for cloud desktop admins
There are three PAW deployment methods, each addressing the same security requirement through a different form factor. The form factor shifts where the security boundary lives. With a physical PAW, TPM and Secure Boot provide the hardware root of trust. With a cloud-hosted PAW, the Azure boundary is the security boundary, and the connecting device becomes an additional risk surface. That distinction is relevant when evaluating the three models below.
Physical PAW
A dedicated physical device, enrolled through Windows Autopilot and managed by Microsoft Intune.
The admin uses it exclusively for accessing Azure portal, the Intune admin center, and management portals. Azure Virtual Desktop session hosts and Windows 365 Cloud PCs remain the managed resources. The PAW is the secured admin endpoint.
Hardware requirements can include TPM 2.0, Secure Boot, UEFI firmware, a 64-bit CPU, and virtualization support depending on the configuration. At the OS level, the PAW configuration commonly includes BitLocker full-disk encryption, Windows Defender Credential Guard to isolate LSASS in a virtualization-based security container, and WDAC to restrict executable code to signed, trusted applications. Windows Defender Application Guard can provide browser isolation when an admin needs a web-based management console outside the allow list.
Windows 365 Cloud PC as a PAW
A dedicated Cloud PC per privileged admin, locked down and configured as the administrative environment.
Practitioner guidance recommends Windows 365 Enterprise edition for this model because it provides control over the virtual network and egress traffic routing. The Business tier does not offer the same network control.
In this model, teams configure an Azure Network Connection in the Intune admin center and map the Cloud PC to a designated PAW network subnet. Network Security Groups on that subnet enforce traffic restrictions. The result is an admin Cloud PC that is network-isolated from production Cloud PCs and can only reach approved administrative endpoints.
Azure Virtual Desktop session host in an isolated virtual network
A separate Azure Virtual Desktop deployment in an isolated VNet provides the privileged environment.
This model offers the most architectural control. You define the compute, networking, and storage configuration. Nerdio Manager can deploy these session hosts from hardened images. The privileged environment starts from CIS hardened images at provisioning rather than relying only on post-deployment lockdown.
Choosing the right model
The right model is the one that best matches your team's operational and trust requirements. Regardless of which form factor you choose, the same Conditional Access enforcement, Intune hardening baselines, and account separation discipline apply. A virtual PAW without Conditional Access leaves the same gap as a physical one without it.
Once the environment exists, Conditional Access and PIM turn it into an enforced control boundary.
Configuring Conditional Access and PIM for enforcement
Technical enforcement turns PAW policy into a control boundary rather than a voluntary standard. Conditional Access enforces the architecture.
Required Entra ID groups
Microsoft's deployment guide specifies four security groups you create before anything else:
- Secure Workstation Users (assigned): users authorized to use PAWs
- Secure Workstation Admins (assigned): admins who manage PAW infrastructure
- Emergency BreakGlass (assigned): emergency access accounts excluded from all Conditional Access policies
- Secure Workstation Devices (dynamic device): auto-identifies enrolled PAW hardware using the rule (device.devicePhysicalIds -any _ -contains "[OrderID]:PAW")
The BreakGlass group is a deployment prerequisite. Every Conditional Access block policy that does not exclude emergency access accounts creates a complete tenant lockout risk. These accounts should be configured and tested before any enforcement is activated.
Conditional Access policies
The enforcement backbone consists of three policies.
- Block non-PAW devices from admin portals. Target all users, exclude BreakGlass group. Scope to Microsoft Admin Portal and Azure Management applications. Use a device filter to exclude PAW device IDs. Grant control: Block. This restricts privileged portal access to registered PAW devices in policy scope.
- Require phishing-resistant MFA on PAW. Target all users, exclude BreakGlass. Scope to Windows 365 and Azure Virtual Desktop applications. Use device filter to include PAW device IDs. Grant control: require authentication strength set to phishing-resistant MFA (FIDO2 security keys or certificate-based authentication).
- Require compliant device for Azure Management. Target Secure Workstation Users group, exclude BreakGlass. Scope to Microsoft Azure Management. Grant control: require MFA and require device marked as compliant.
Teams should deploy every policy in report-only mode for at least one week. Teams should review sign-in logs and communicate changes to affected admins before switching to enforcement. Skipping validation risks disrupting active session host management.
One critical scope note applies here. Azure Virtual Desktop control plane authentication and session host access are separate authentication flows. You need separate policies addressing each flow using the correct application scope for Windows 365 and Azure Virtual Desktop policies.
PIM for just-in-time elevation
Microsoft Entra Privileged Identity Management (requires Entra ID P2) eliminates standing admin rights. Admins hold eligible role assignments rather than permanent ones. When admins need Global Administrator or Intune Administrator privileges, they activate the role with a time-bound window, a justification, and an approval workflow.
PIM integrates with Conditional Access through authentication context, so you can apply Conditional Access requirements to role activation.
Together, the Entra ID security groups, three Conditional Access policies, and PIM eligible assignments form a layered enforcement model. The BreakGlass accounts ensure you retain emergency access when any of these controls behave unexpectedly. Nerdio Manager's configuration drift tracking flags managed settings that drift from baseline after deployment. Your team can catch a changed firewall rule or a disabled compliance policy before the next audit cycle.
In practice, PAW enforcement succeeds when these controls work together, where:
- group scoping defines who and what qualifies
- Conditional Access blocks bypass paths within policy scope
- PIM removes standing privilege
That enforcement layer makes the deployment models in the previous section safer than standard admin access.
Compliance framework alignment
NIST describes that controls AC-6(5) and AC-6(2) restrict privileged accounts to defined personnel and require non-privileged accounts for non-security functions. Control SC-2 includes supplemental guidance that points to virtualization techniques as a way to separate system and user functionality. Applied to this architecture, that guidance can support using a Windows 365 Cloud PC or Azure Virtual Desktop session as a distinct privileged environment.
The UK NCSC guidance published guidance titled "Principles for secure privileged access workstations (PAWs)" in March 2025, introducing 10 principles for secure PAWs. NCSC's framework says PAWs should prevent direct access to risky services and recommends technical controls such as remote desktop solutions, but it does not explicitly state that VDI and jump hosts must only be accessed from a PAW.
How Nerdio Manager supports PAW governance
Many enterprises run both Windows 365 and Azure Virtual Desktop. Nerdio Manager for Enterprise adds a shared management layer across them both, so the same image, policy, application, and configuration workflows apply to privileged environments on either path instead of splitting the work between separate admin surfaces.
Shared controls across both paths
Nerdio Manager gives admins a single console for CIS hardened image selection, compliance baselines, provisioning policies, application deployment, and configuration tasks across Azure portal, PowerShell, and Microsoft Intune. Granular RBAC limits the administrative blast radius by controlling which actions each operator can perform.
Configuration drift tracking flags managed configurations that deviate from your security baselines, and Nerdio Manager includes CIS-certified policy baselines out of the box. Scripted Actions run across Azure Virtual Desktop and Windows 365 with minimal modification, so hardening scripts built for session hosts apply to Cloud PCs as well.
Azure Virtual Desktop session host hardening
On the Azure Virtual Desktop side, Nerdio Manager provides CIS hardened images for session host deployment and provisioning automation. Your team can stand up isolated privileged environments from hardened images at provisioning rather than hardening them later.
Windows 365 Cloud PC governance
On the Windows 365 side, Nerdio Manager extends the Intune management work that comes with every Cloud PC through provisioning policies, application deployment, and Intune policy backup and restore (a capability native Intune does not offer). Teams that want more depth on the Cloud PC side can review Windows 365 with Nerdio and Nerdio for Intune.
What to get right before you enforce PAW policies
Architecture is the easy part. Getting your team to actually use the PAW without building workarounds is where deployments stall.
- Admin training before enforcement prevents workarounds. The PAW's restrictions, including no email, no general browsing, and locked-down application execution, are intentional. Surprising your team with them creates workarounds that defeat the architecture.
- The simultaneous-use hardware profile reduces friction for admins carrying one device. Use a hardened PAW for privileged administration and use remote sessions such as Azure Virtual Desktop or Windows 365 for user work.
- Mixing PAW Users and PAW Maintenance group memberships creates an escalation path. Separate PAW Users from PAW Maintenance and keep PAW Users out of local Administrators, which helps prevent escalation risks if PAWs span tiers. The same account should never be added to both groups.
- Local administrator rights removal closes an escalation path. Teams typically use Intune to remove these rights and deploy Windows LAPS alongside the change. Teams should test all existing administrative tools against the non-admin configuration before rollout.
- License-level email removal is often more durable than policy-based blocking. Removing Exchange Online from the PAW admin account's license eliminates the service entirely. Policy-layer controls can be misconfigured or reversed; license-level removal cannot.
- Phased deployment reduces rollout risk. Microsoft's phased approach starts with Tier 0 (identity and directory administrators), expands to Tier 1 (server and application administrators), and extends to Tier 2 (workstations and user devices), with protections such as Credential Guard and Device Guard applied to hardened endpoints and privileged workstations.
- Continuous compliance monitoring catches drift after enforcement. Teams typically route Defender for Endpoint telemetry and Entra ID sign-in logs to their SIEM. A PAW device can be configured so that if its Defender for Endpoint risk level rises above the Intune compliance policy's allowed threshold, Intune automatically marks it noncompliant and Conditional Access can block access without analyst intervention. PIM activation logs provide an audit trail of every privileged role activation.
Across all seven, the common thread is that technical controls only hold if admins adopt the PAW consistently. Pair the rollout with training, monitoring, and phased enforcement to keep the boundary intact.
Keep privileged sessions off everyday endpoints
The core goal is the same one this article opened with: keep Global Administrator, Intune, and Entra admin sessions off the same everyday laptops your team uses for email, Slack, and general browsing. If admins do not adopt the PAW consistently, the architecture collapses back into the exact credential-exposure scenario these controls are meant to prevent.
A PAW deployment only works if it keeps that boundary intact and enforces it with Conditional Access and PIM, so privileged sessions remain in the hardened admin environment instead of drifting back to everyday endpoints. If your team is also hardening the surrounding desktop stack, related guidance on AVD security best practices and Intune management can help extend the same discipline beyond the PAW itself.
Get a demo to see how Nerdio Manager supports hardened image, policy, application, and configuration governance across your Windows 365 and Azure Virtual Desktop environment, or try it free in your own Azure tenant.
Frequently asked questions about privileged access workstations
Resources
Learn more about Nerdio Manager
