Privileged Access Workstations: A Defensive Tier for CUI Administrators

A dedicated administrative device tier reduces blast radius for CUI systems. You deploy Privileged Access Workstations (PAWs) to contain privileged activity on hardened, managed devices and to keep admin sessions away from phishing, web browsing, and personal use. Microsoft describes PAWs as a device trust boundary for privileged operations, and the NIST SP 800-171 Rev. 2 and CMMC Level 2 material align with the associated practices for least privilege, separate non-privileged use, multifactor authentication, authorization of privileged remote access, and logging of privileged functions.

Privileged access workstation definition

Microsoft defines a PAW as a hardened, managed Windows workstation used exclusively for privileged tasks and isolated from common attack vectors. Microsoft calls out Microsoft Intune, Microsoft Entra ID, and Microsoft Defender for Endpoint as core services that help enforce device trust for administrative sessions. Microsoft further directs teams to run privileged sessions only from trusted devices, using device-compliance and device-risk signals as gates.

Microsoft lists supported PAW hardware capabilities that raise assurance. Teams procure devices with TPM 2.0 and UEFI Secure Boot, then enable BitLocker to protect data at rest. You can raise the bar again by enabling virtualization-based security with HVCI to resist kernel tampering.

Microsoft’s privileged access guidance also calls for separate administrative accounts and dedicated privileged devices. Administrators avoid performing privileged actions from standard user sessions, and they avoid unmanaged or noncompliant devices for admin work.

Separate device tier for CUI administrators

Adversaries target administrator tokens and toolchains. You reduce that attack surface when you split daily productivity from privileged work. A PAW tier blocks browser plug-ins, unvetted local tools, and consumer apps from sitting next to elevated sessions. You place a gate in front of sensitive consoles and security-relevant endpoints, then require a known device state before entry.

That separation aligns with core requirements. NIST SP 800-171 Rev. 2 requires organizations to employ least privilege, including for privileged accounts, and to use non-privileged accounts for nonsecurity functions. The model also requires prevention of non-privileged execution of privileged functions and capture of privileged function execution in audit logs. For identity strength, NIST requires multifactor authentication for local and network access to privileged accounts, and for network access to non-privileged accounts. For remote administration, NIST requires you to authorize remote execution of privileged commands and remote access to security-relevant information.

A PAW tier gives you a sensible place to enforce those safeguards. You can bind privileged sessions to a compliant device posture, require MFA at each elevation, and log administrator operations with central analytics. The device tier does not replace policy or process. It gives your team a bounded path where you can enforce them.

CMMC Level 2 mapping

A PAW pattern supports several CMMC Level 2 practices that derive from NIST SP 800-171 Rev. 2. It does not stand alone as a named practice. You still define roles, authorize access, and produce evidence.

AC.L2-3.1.5. Employ least privilege, including for specific security functions and privileged accounts. A PAW tier helps you gate those accounts behind a known device state and a hardened operating posture.
AC.L2-3.1.6. Use non-privileged accounts or roles when accessing nonsecurity functions. You keep email, web, and general productivity off the PAW and you keep admin sessions off the daily-use device.
AC.L2-3.1.7. Prevent non-privileged users from executing privileged functions, and capture execution of those functions in audit logs. You restrict admin tools to PAWs and collect logs of administrative actions for review.
AC.L2-3.1.12. Authorize remote execution of privileged commands and access to security-relevant information. You document which administrators can perform remote privileged actions, from which device tier, and under which conditions.
IA.L2-3.5.3. Use multifactor authentication for local and network access to privileged accounts, and for network access to non-privileged accounts. You require MFA for the PAW sign-in and again for role activation or elevation.
AU.L2-3.3.1 and AU.L2-3.3.9. Create and retain audit records for monitoring and investigation, and limit management of audit logging to a subset of privileged users. You collect PAW sign-ins, role activations, and administrative changes, and you limit who can alter logging.

The CMMC Level 2 Assessment Guide evaluates whether you identify privileged accounts and authorize access to them according to least privilege and MFA requirements. It also evaluates authorization for remote privileged commands and access to security-relevant information. A PAW tier gives assessors a clear administrative path to examine, along with device and identity controls they can test.

For a quick crosswalk of these controls, see our overview at NIST 800-171 and CMMC Level 2 Mapping.

Building a PAW with Microsoft security controls

You can deploy a PAW tier with Microsoft’s identity, device, and endpoint security stack. The following pattern aligns with Microsoft’s PAW guidance. Confirm service availability and feature support for your tenant type before you set standards, especially in GCC, GCC High, or DoD environments.

Device enrollment and compliance. Enroll PAWs in Microsoft Intune, assign a hardened configuration profile, and enforce compliance policies that set minimum OS version, secure boot, disk encryption, and threat protection. Use compliance state as a gate for admin access. For practical profiles and settings, see our baseline guidance at Intune Compliance Baseline for CUI.
Endpoint risk and isolation. Onboard PAWs to Microsoft Defender for Endpoint and feed device risk back to the access policy. Use attack surface reduction, controlled folder access, and application control where feasible. Restrict general-purpose browsing and unapproved tools on the PAW.
Identity controls and elevation. Enforce sign-in with Microsoft Entra ID. Use Conditional Access to restrict privileged portals and PowerShell endpoints to compliant PAWs and to require MFA. Separate admin accounts from user accounts and keep those admin accounts licensed and monitored. Use time-bound role activation with Privileged Identity Management where supported.
Logging and monitoring. Send sign-ins, role activations, device state changes, and policy changes to a central log. Microsoft Sentinel can collect and alert on privileged sign-ins, role activations, and configuration changes for organizations that use it. Limit who can alter logging configuration and verify retention.

Hardware and OS configuration matter. Equip PAWs with TPM 2.0 and enable UEFI Secure Boot. Turn on BitLocker with a strong recovery key process. Enable virtualization-based security with HVCI where device CPU and drivers support it. Keep local admin separate from the daily-use identity and restrict local toolsets to those needed for the job.

The Microsoft Product Placemat for CMMC 2.0 remains a preview reference. Treat it as informational, not an authorization or guarantee for control coverage.

Evidence, scope, and operational boundaries

A PAW tier shifts the administrative boundary of your CUI system. You should reflect that shift in your system security plan, scoping documents, and procedures. Describe the tier as part of the protected administrative path. Define which identities can use the tier, which systems they can administer, and which device controls you enforce.

Scope and boundary. Identify PAWs as part of the CUI environment if they perform administration of in-scope systems. Document how you route connections from PAWs to on-premises assets, cloud services, and enclave systems. If you maintain a segmented CUI enclave, describe the jump path or broker that connects PAWs to enclave assets. For background on boundary definition, see CMMC Scoping and the CUI Boundary.

Account and authorization. Maintain a register of privileged roles and named administrators. Assign admin roles to separate accounts. Document approvals for remote privileged commands and for access to security-relevant information. Tie each authorization to a role and a device tier.

Access enforcement. Preserve Conditional Access policies that restrict privileged entry to compliant PAWs and that require MFA at sign-in and elevation. Preserve Intune device-compliance policies that enforce encryption, secure boot, supported OS versions, and threat protection. Keep Defender for Endpoint device-risk policies that feed the gate.

Logging and monitoring. Store logs for PAW sign-ins, role activations, administrative actions, and policy changes. Include device state changes that affect trust, such as tamper protection changes or onboarding state. Limit who can alter logging configuration. Retain evidence that shows your team reviews these events and acts on them.

Operational discipline. Train administrators to avoid non-privileged browsing or personal use on the PAW. Train them to avoid privileged activity from non-PAW devices. Document steps to request temporary exceptions, with approvals and time bounds, and preserve records when you grant them.

Assessment readiness. The CMMC Level 2 Assessment Guide focuses on whether your team identified privileged accounts, authorized access to them based on least privilege, enforced MFA where required, and authorized remote privileged activity. A PAW tier helps you present those controls in a clear, testable manner. It does not replace your responsibility to define the system boundary, maintain policies and procedures, and produce evidence.

Practical cautions on Microsoft cloud environments

Microsoft’s PAW guidance describes the pattern and the controls. Service availability and feature behavior can differ across commercial, GCC, GCC High, and DoD tenants. Verify current documentation for Intune, Entra ID, Defender for Endpoint, Conditional Access, Privileged Identity Management, and Sentinel in your tenant type before you write standards or design gates. Align your PAW build and your enforcement rules with what the government cloud supports in your subscription.