Require a dedicated administration workstation for administrative roles

Description

A Conditional Access policy targets the users holding privileged directory roles (same role list as CB-M365-AUTH-004), on all resources, and blocks access from any device that is not a dedicated administration workstation. The workstations are identified by the device filter {{ paw_device_filter }} (set by an Intune or device administrator, not by users) and are Intune-managed and compliant. The emergency access accounts are excluded.

Administration workstations follow the organization's hardening rules: no general Internet browsing, no mail, restricted software.

Device filters rely on device attributes such as extensionAttribute1 to extensionAttribute15, which only a device administrator can set through Microsoft Graph. An alternative is to require a compliant device with a dedicated Intune compliance policy assigned to the workstations.

Rationale

Admin credentials and tokens are only as safe as the device that uses them. A token stolen from an everyday workstation by infostealer malware bypasses MFA. Restricting admin sign-ins to dedicated, hardened devices keeps privileged sessions away from the devices most exposed to phishing and malicious downloads.

Impact

Each administrator needs a dedicated device (physical, or a hardened virtual machine where the organization's model allows it), and the device attribute must be set and protected. Admin work from other devices is blocked, including on-call work from home without the workstation.

Applies when

Requires: Microsoft Entra ID P1

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Security Reader.
2. Browse to Entra ID > Conditional Access > Policies and find a policy with State On where:
   • Users > Include lists the privileged Directory roles; Exclude contains only the emergency access accounts;
   • Target resources includes All resources;
   • Conditions > Filter for devices excludes devices matching {{ paw_device_filter }}, and Grant is Block access (or the policy requires a compliant device with a compliance policy only assigned to the workstations).
3. Check in Intune that the devices matching the filter are the inventoried administration workstations.
4. Read-only PowerShell alternative (Microsoft Graph, scope Policy.Read.All): Get-MgIdentityConditionalAccessPolicy -All | Where-Object { $_.Conditions.Devices.DeviceFilter.Rule }.
5. Fail if no such policy is enabled or if devices outside the inventory match the filter.

Remediation

1. With an Intune Administrator or Cloud Device Administrator, set the attribute on each administration workstation, for example with Microsoft Graph: PATCH /devices/{id} with {"extensionAttributes": {"extensionAttribute1": "PAW"}}.
2. With a Conditional Access Administrator, browse to Entra ID > Conditional Access > Policies > New policy, name it ADM - Require administration workstation.
3. Users: include the privileged directory roles, exclude the emergency access accounts.
4. Target resources: All resources.
5. Conditions > Filter for devices: Configure Yes, Exclude filtered devices from policy, rule {{ paw_device_filter }}.
6. Grant: Block access.
7. Set Enable policy to Report-only, check the sign-in logs for a few days, then switch to On.

Rollback

Set the policy to Report-only or Off.

References

• Conditional Access filter for devices Microsoft, vendor-doc, accessed 2026-10-24
• Privileged access devices Microsoft, vendor-doc, accessed 2026-10-24
• ANSSI, Recommandations relatives à l'administration sécurisée des SI ANSSI, guide, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-004 Require phishing-resistant MFA for administrative roles

People and lifecycle