{
  "id": "CB-M365-ADMIN-016",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-016",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-016.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-016.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-ADMIN-016",
    "title": "Require a dedicated administration workstation for administrative roles",
    "finding": {
      "title": "Administrators can sign in from any device",
      "description": "Admin sessions can run on the same workstation that browses the Internet and reads mail, where malware can steal the session tokens."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "privileged-access",
      "paw",
      "conditional-access",
      "device-filter",
      "admin-workstation"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P1"
      ]
    },
    "parameters": [
      {
        "name": "paw_device_filter",
        "type": "string",
        "description": "Conditional Access device filter rule that matches the dedicated administration workstations.",
        "default": "device.extensionAttribute1 -eq \"PAW\""
      }
    ],
    "description": "A Conditional Access policy targets the users holding privileged directory roles (same role list\nas CB-M365-AUTH-004), on all resources, and blocks access from any device that is not a dedicated\nadministration workstation. The workstations are identified by the device filter\n`{{ paw_device_filter }}` (set by an Intune or device administrator, not by users) and are\nIntune-managed and compliant. The emergency access accounts are excluded.\n\nAdministration workstations follow the organization's hardening rules: no general Internet\nbrowsing, no mail, restricted software.\n",
    "rationale": "Admin credentials and tokens are only as safe as the device that uses them. A token stolen from\nan everyday workstation by infostealer malware bypasses MFA. Restricting admin sign-ins to\ndedicated, hardened devices keeps privileged sessions away from the devices most exposed to\nphishing and malicious downloads.\n",
    "impact": "Each administrator needs a dedicated device (physical, or a hardened virtual machine where the\norganization's model allows it), and the device attribute must be set and protected. Admin work\nfrom other devices is blocked, including on-call work from home without the workstation.\n",
    "notes": "Device filters rely on device attributes such as `extensionAttribute1` to `extensionAttribute15`,\nwhich only a device administrator can set through Microsoft Graph. An alternative is to require a\ncompliant device with a dedicated Intune compliance policy assigned to the workstations.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Entra ID** > **Conditional Access** > **Policies** and find a policy with\n   **State** **On** where:\n   - **Users** > **Include** lists the privileged **Directory roles**; **Exclude** contains\n     only the emergency access accounts;\n   - **Target resources** includes **All resources**;\n   - **Conditions** > **Filter for devices** excludes devices matching\n     `{{ paw_device_filter }}`, and **Grant** is **Block access** (or the policy requires a\n     compliant device with a compliance policy only assigned to the workstations).\n3. Check in Intune that the devices matching the filter are the inventoried administration\n   workstations.\n4. Read-only PowerShell alternative (Microsoft Graph, scope `Policy.Read.All`):\n   `Get-MgIdentityConditionalAccessPolicy -All | Where-Object { $_.Conditions.Devices.DeviceFilter.Rule }`.\n5. Fail if no such policy is enabled or if devices outside the inventory match the filter.\n"
    },
    "remediation": {
      "manual": "1. With an Intune Administrator or Cloud Device Administrator, set the attribute on each\n   administration workstation, for example with Microsoft Graph:\n   `PATCH /devices/{id}` with `{\"extensionAttributes\": {\"extensionAttribute1\": \"PAW\"}}`.\n2. With a Conditional Access Administrator, browse to **Entra ID** > **Conditional Access** >\n   **Policies** > **New policy**, name it `ADM - Require administration workstation`.\n3. **Users**: include the privileged directory roles, exclude the emergency access accounts.\n4. **Target resources**: **All resources**.\n5. **Conditions** > **Filter for devices**: **Configure** **Yes**, **Exclude filtered devices\n   from policy**, rule `{{ paw_device_filter }}`.\n6. **Grant**: **Block access**.\n7. Set **Enable policy** to **Report-only**, check the sign-in logs for a few days, then\n   switch to **On**.\n",
      "rollback": "Set the policy to **Report-only** or **Off**.\n"
    },
    "references": [
      {
        "title": "Conditional Access filter for devices",
        "url": "https://learn.microsoft.com/entra/identity/conditional-access/concept-condition-filters-for-devices",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Privileged access devices",
        "url": "https://learn.microsoft.com/security/privileged-access-workstations/privileged-access-devices",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "ANSSI, Recommandations relatives à l'administration sécurisée des SI",
        "url": "https://cyber.gouv.fr/publications/recommandations-relatives-ladministration-securisee-des-si",
        "publisher": "ANSSI",
        "kind": "guide",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-admin",
        "framework_version": "3.0",
        "id": "R9",
        "relation": "partial",
        "note": "The tenant enforces that admins sign in from the dedicated workstation; the workstation itself is out of scope."
      },
      {
        "framework": "anssi-admin",
        "framework_version": "3.0",
        "id": "R10",
        "relation": "related",
        "note": "Internet filtering of the workstation is not checked by this control."
      },
      {
        "framework": "anssi-admin",
        "framework_version": "3.0",
        "id": "R11",
        "relation": "related",
        "note": "Hardening of the workstation operating system is not checked by this control."
      },
      {
        "framework": "anssi-admin",
        "framework_version": "3.0",
        "id": "R29",
        "relation": "partial",
        "note": "Restricts where admin accounts are used, not what they are used for."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6(2)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-17(4)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1539"
      },
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-004",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}