Question

A financial services company is finalizing its privileged access strategy based on the Microsoft Cybersecurity Reference Architectures (MCRA). Tier 0 administrators (domain admins, Entra ID Global Admins, and cloud subscription owners) currently perform administrative tasks from their standard corporate laptops, which are also used for email and web browsing. Security architects want to eliminate the risk of credential theft and keylogging malware compromising these high-value identities. Which design should they recommend as the primary control for Tier 0 administrative access?

Accepted Answer

Deploy dedicated Privileged Access Workstations (PAWs) that are hardened, isolated from internet/email, and used exclusively for Tier 0 administrative tasks

Answer

Require multifactor authentication on the administrators' existing laptops and enroll them in Microsoft Intune compliance policies

Answer

Grant Tier 0 privileges through Microsoft Entra Privileged Identity Management (PIM) just-in-time activation from their standard laptops

Answer

Install Microsoft Defender for Endpoint on the corporate laptops and route all administrative traffic through Entra Private Access