# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-ADMIN-016
title: Require a dedicated administration workstation for administrative roles
finding:
  title: Administrators can sign in from any device
  description: Admin sessions can run on the same workstation that browses the Internet and reads mail, where malware can steal the session tokens.
status: active
profiles: [hardened]
risk:
  severity: medium
assessment: manual
tags: [privileged-access, paw, conditional-access, device-filter, admin-workstation]

applicability:
  requires:
    - "Microsoft Entra ID P1"

parameters:
  - name: paw_device_filter
    type: string
    description: Conditional Access device filter rule that matches the dedicated administration workstations.
    default: 'device.extensionAttribute1 -eq "PAW"'

description: |
  A Conditional Access policy targets the users holding privileged directory roles (same role list
  as CB-M365-AUTH-004), on all resources, and blocks access from any device that is not a dedicated
  administration workstation. The workstations are identified by the device filter
  `{{ paw_device_filter }}` (set by an Intune or device administrator, not by users) and are
  Intune-managed and compliant. The emergency access accounts are excluded.

  Administration workstations follow the organization's hardening rules: no general Internet
  browsing, no mail, restricted software.
rationale: |
  Admin credentials and tokens are only as safe as the device that uses them. A token stolen from
  an everyday workstation by infostealer malware bypasses MFA. Restricting admin sign-ins to
  dedicated, hardened devices keeps privileged sessions away from the devices most exposed to
  phishing and malicious downloads.
impact: |
  Each administrator needs a dedicated device (physical, or a hardened virtual machine where the
  organization's model allows it), and the device attribute must be set and protected. Admin work
  from other devices is blocked, including on-call work from home without the workstation.
notes: |
  Device filters rely on device attributes such as `extensionAttribute1` to `extensionAttribute15`,
  which only a device administrator can set through Microsoft Graph. An alternative is to require a
  compliant device with a dedicated Intune compliance policy assigned to the workstations.

audit:
  manual: |
    1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a
       Security Reader.
    2. Browse to **Entra ID** > **Conditional Access** > **Policies** and find a policy with
       **State** **On** where:
       - **Users** > **Include** lists the privileged **Directory roles**; **Exclude** contains
         only the emergency access accounts;
       - **Target resources** includes **All resources**;
       - **Conditions** > **Filter for devices** excludes devices matching
         `{{ paw_device_filter }}`, and **Grant** is **Block access** (or the policy requires a
         compliant device with a compliance policy only assigned to the workstations).
    3. Check in Intune that the devices matching the filter are the inventoried administration
       workstations.
    4. Read-only PowerShell alternative (Microsoft Graph, scope `Policy.Read.All`):
       `Get-MgIdentityConditionalAccessPolicy -All | Where-Object { $_.Conditions.Devices.DeviceFilter.Rule }`.
    5. Fail if no such policy is enabled or if devices outside the inventory match the filter.

remediation:
  manual: |
    1. With an Intune Administrator or Cloud Device Administrator, set the attribute on each
       administration workstation, for example with Microsoft Graph:
       `PATCH /devices/{id}` with `{"extensionAttributes": {"extensionAttribute1": "PAW"}}`.
    2. With a Conditional Access Administrator, browse to **Entra ID** > **Conditional Access** >
       **Policies** > **New policy**, name it `ADM - Require administration workstation`.
    3. **Users**: include the privileged directory roles, exclude the emergency access accounts.
    4. **Target resources**: **All resources**.
    5. **Conditions** > **Filter for devices**: **Configure** **Yes**, **Exclude filtered devices
       from policy**, rule `{{ paw_device_filter }}`.
    6. **Grant**: **Block access**.
    7. Set **Enable policy** to **Report-only**, check the sign-in logs for a few days, then
       switch to **On**.
  rollback: |
    Set the policy to **Report-only** or **Off**.

references:
  - title: Conditional Access filter for devices
    url: https://learn.microsoft.com/entra/identity/conditional-access/concept-condition-filters-for-devices
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Privileged access devices
    url: https://learn.microsoft.com/security/privileged-access-workstations/privileged-access-devices
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: ANSSI, Recommandations relatives à l'administration sécurisée des SI
    url: https://cyber.gouv.fr/publications/recommandations-relatives-ladministration-securisee-des-si
    publisher: ANSSI
    kind: guide
    accessed: 2026-10-24
mappings:
  - framework: anssi-admin
    framework_version: "3.0"
    id: "R9"
    relation: partial
    note: The tenant enforces that admins sign in from the dedicated workstation; the workstation itself is out of scope.
  - framework: anssi-admin
    framework_version: "3.0"
    id: "R10"
    relation: related
    note: Internet filtering of the workstation is not checked by this control.
  - framework: anssi-admin
    framework_version: "3.0"
    id: "R11"
    relation: related
    note: Hardening of the workstation operating system is not checked by this control.
  - framework: anssi-admin
    framework_version: "3.0"
    id: "R29"
    relation: partial
    note: Restricts where admin accounts are used, not what they are used for.
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-6(2)
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-17(4)
    relation: related
threats:
  - framework: mitre-attack
    id: T1539
  - framework: mitre-attack
    id: T1078.004
related_controls:
  - id: CB-M365-AUTH-004
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24