paw-design

Name: paw-design
Author: vinayaklatthe

161stars34forks

How to install paw-design?

vinayaklatthe/microsoft-security-skills/paw-design

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill paw-design

Installs into the current project.

Summary

Guidance for designing Privileged Access Workstations (PAW) and the Microsoft privileged access strategy (enterprise access model, clean source principle, tiered admin isolation). Covers when to use Enterprise vs Specialized vs Privileged device profiles, hardening (Entra-join, I

Files · 1

View on GitHub

SKILL.md

1	# Privileged Access Workstation (PAW) Design
2
3	A Privileged Access Workstation (PAW) is a hardened, dedicated device used only for
4	privileged tasks - isolating sensitive accounts from browsing, email, and arbitrary apps.
5	PAWs are the device pillar of Microsoft's privileged access strategy and the enforcement
6	point for the clean source principle.
7
8	## When to use
9	Protecting administrators of high-value systems (Entra control plane, Azure root, domain
10	controllers, identity infrastructure - "Tier 0") from credential theft, browser exploit, and
11	supply-chain attack. Use this skill to choose the device tier, harden the build, and enforce
12	PAW-only access via CA.
13
14	Do not use this skill for general endpoint hardening (`defender-for-endpoint`) or
15	device compliance baseline (`intune-device-mgmt`).
16
17	## Pick the device profile by admin tier
18
19	The enterprise access model maps admin roles to three device profiles. Wrong tier = either
20	over-spending or under-protecting.
21
22	\| Tier \| Roles in scope \| Device profile \| What's allowed \|
23	\|---\|---\|---\|---\|
24	\| Privileged (PAW) \| Global Admin, Privileged Auth Admin, Tier 0 Azure Owner, Domain Admin, DC operators \| Dedicated hardened device \| Admin portals only; no email, no browsing \|
25	\| Specialized \| Workload admins (Exchange, SharePoint, Intune, SQL DBA), Tier 1 Azure Contributor \| Hardened build; some productivity \| Admin portals + curated productivity (Office) \|
26	\| Enterprise \| Help desk, Tier 2 ops, Reports Reader, Security Reader \| Standard managed device + strong baseline \| Full productivity with MDE + ASR + tamper protection \|
27
28	> Rule of thumb: the test for "needs a PAW" is **can this account log into a domain
29	> controller, modify Conditional Access, or assume the root Azure subscription**? If yes,
30	> PAW. If only managing one workload, Specialized. The PAW population should be small
31	> (typically < 1% of admins).
32
33	## Approach
34
35	1. Adopt the enterprise access model — Map every privileged role to control / management
36	/ data plane. Tier 0 = control plane (identity, cloud control plane, on-prem AD). Tier 1
37	= workload admins. Tier 2 = ops / read-only. Devices, accounts, and access paths must
38	match the tier.
39	Verify: tier mapping document signed off; Tier 0 role count documented.
40
41	2. Apply the clean source principle — Any security dependency must be as trustworthy as
42	the object it secures. Tier 0 administered only from Tier 0 devices. No "I'll just RDP
43	from my laptop this once" - that breaks the model.
44
45	3. Build the PAW image — Entra-joined (not hybrid where possible), Intune-managed,
46	hardware root of trust (TPM 2.0 + UEFI Secure Boot), app allowlisting (WDAC or
47	AppLocker), Credential Guard + Memory Integrity on, BitLocker, Defender for
48	Endpoint with all ASR rules in block mode, no inbound RDP, restrictive outbound firewall.
49	Verify: WDAC policy enforced (not audit); Credential Guard running (msinfo32).
50
51	4. Lock down user experience — No local admin, no email client, no general browsing
52	(block via DNS / firewall to non-admin endpoints), Edge restricted to admin portal URLs
53	only. No USB storage. No app installs by user.
54
55	5. Enforce via Conditional Access — CA policy: Tier 0 roles can sign in only from a
56	compliant device with the PAW device filter (custom attribute). Anything else =
57	block. This is the control that makes the PAW non-optional.
58	Verify: CA policy in enforce mode; What If a Tier 0 sign-in from a non-PAW = blocked.
59
60	7. Pair PAW with PIM, phishing-resistant MFA, and dedicated admin accounts — PAWs run
61	with non-privileged accounts day-to-day; admin credential is FIDO2 + PIM-eligible,
62	activated just-in-time for the task.
63
64	7. Pilot 5 PAWs first — Tier 0 admins are vocal. Hand-deliver, walk through, gather
65	friction reports, iterate. Then scale.
66
67	## Guardrails
68	- A PAW used for productivity is no longer a PAW. No email, no browsing, no Teams
69	chat. Provide a separate Enterprise device for productivity if needed (yes, two devices).
70	- Protect the management chain. Intune and the im

People who liked this also viewed

6 picks

Type

paw-design

161stars34forks

View on GitHub

How to install paw-design?

vinayaklatthe/microsoft-security-skills/paw-design

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill paw-design

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Privileged Access Workstation (PAW) Design
2
3	A Privileged Access Workstation (PAW) is a hardened, dedicated device used only for
4	privileged tasks - isolating sensitive accounts from browsing, email, and arbitrary apps.
5	PAWs are the device pillar of Microsoft's privileged access strategy and the enforcement
6	point for the clean source principle.
7
8	## When to use
9	Protecting administrators of high-value systems (Entra control plane, Azure root, domain
10	controllers, identity infrastructure - "Tier 0") from credential theft, browser exploit, and
11	supply-chain attack. Use this skill to choose the device tier, harden the build, and enforce
12	PAW-only access via CA.
13
14	Do not use this skill for general endpoint hardening (`defender-for-endpoint`) or
15	device compliance baseline (`intune-device-mgmt`).
16
17	## Pick the device profile by admin tier
18
19	The enterprise access model maps admin roles to three device profiles. Wrong tier = either
20	over-spending or under-protecting.
21
22	\| Tier \| Roles in scope \| Device profile \| What's allowed \|
23	\|---\|---\|---\|---\|
24	\| Privileged (PAW) \| Global Admin, Privileged Auth Admin, Tier 0 Azure Owner, Domain Admin, DC operators \| Dedicated hardened device \| Admin portals only; no email, no browsing \|
25	\| Specialized \| Workload admins (Exchange, SharePoint, Intune, SQL DBA), Tier 1 Azure Contributor \| Hardened build; some productivity \| Admin portals + curated productivity (Office) \|
26	\| Enterprise \| Help desk, Tier 2 ops, Reports Reader, Security Reader \| Standard managed device + strong baseline \| Full productivity with MDE + ASR + tamper protection \|
27
28	> Rule of thumb: the test for "needs a PAW" is **can this account log into a domain
29	> controller, modify Conditional Access, or assume the root Azure subscription**? If yes,
30	> PAW. If only managing one workload, Specialized. The PAW population should be small
31	> (typically < 1% of admins).
32
33	## Approach
34
35	1. Adopt the enterprise access model — Map every privileged role to control / management
36	/ data plane. Tier 0 = control plane (identity, cloud control plane, on-prem AD). Tier 1
37	= workload admins. Tier 2 = ops / read-only. Devices, accounts, and access paths must
38	match the tier.
39	Verify: tier mapping document signed off; Tier 0 role count documented.
40
41	2. Apply the clean source principle — Any security dependency must be as trustworthy as
42	the object it secures. Tier 0 administered only from Tier 0 devices. No "I'll just RDP
43	from my laptop this once" - that breaks the model.
44
45	3. Build the PAW image — Entra-joined (not hybrid where possible), Intune-managed,
46	hardware root of trust (TPM 2.0 + UEFI Secure Boot), app allowlisting (WDAC or
47	AppLocker), Credential Guard + Memory Integrity on, BitLocker, Defender for
48	Endpoint with all ASR rules in block mode, no inbound RDP, restrictive outbound firewall.
49	Verify: WDAC policy enforced (not audit); Credential Guard running (msinfo32).
50
51	4. Lock down user experience — No local admin, no email client, no general browsing
52	(block via DNS / firewall to non-admin endpoints), Edge restricted to admin portal URLs
53	only. No USB storage. No app installs by user.
54
55	5. Enforce via Conditional Access — CA policy: Tier 0 roles can sign in only from a
56	compliant device with the PAW device filter (custom attribute). Anything else =
57	block. This is the control that makes the PAW non-optional.
58	Verify: CA policy in enforce mode; What If a Tier 0 sign-in from a non-PAW = blocked.
59
60	7. Pair PAW with PIM, phishing-resistant MFA, and dedicated admin accounts — PAWs run
61	with non-privileged accounts day-to-day; admin credential is FIDO2 + PIM-eligible,
62	activated just-in-time for the task.
63
64	7. Pilot 5 PAWs first — Tier 0 admins are vocal. Hand-deliver, walk through, gather
65	friction reports, iterate. Then scale.
66
67	## Guardrails
68	- A PAW used for productivity is no longer a PAW. No email, no browsing, no Teams
69	chat. Provide a separate Enterprise device for productivity if needed (yes, two devices).
70	- Protect the management chain. Intune and the im

People who liked this also viewed

6 picks

Type