Question

A financial services company is deploying an Azure landing zone using the Cloud Adoption Framework enterprise-scale architecture. During a tabletop ransomware exercise, the security team discovers that domain administrators use the same workstations for email, web browsing, and administering both on-premises Active Directory and Azure privileged roles. The CISO wants to prioritize privileged access hardening as the first control to reduce the blast radius of a credential-theft attack. Following Microsoft's Enterprise Access Model and MCRA guidance, which approach should you recommend?

Accepted Answer

Deploy dedicated, hardened privileged access workstations (PAWs) for Control Plane and Management Plane administration, combined with just-in-time role activation via Privileged Identity Management.

Answer

Require all administrators to enable Azure AD Multi-Factor Authentication and enroll their existing daily-use laptops in Microsoft Intune compliance policies.

Answer

Place all administrative accounts in a single high-privilege group and protect it with a Conditional Access policy that blocks legacy authentication.

Answer

Move all administrative activity into an Azure Bastion session so administrators never expose RDP ports directly to the internet.