# privileged-access-workstation

Source: https://startwithidentity.com/glossary/privileged-access-workstation/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

A privileged access workstation (PAW) is a dedicated, hardened computer used only for administrative work, with no email, no general web browsing and only approved applications, so that a phishing email or malicious website cannot reach the device that holds admin credentials. [Microsoft's privileged access guidance](https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-devices) calls it "the highest security configuration designed for extremely sensitive roles."

Microsoft defines three device levels, and the PAW is the top one:

| Control | Enterprise | Specialized | Privileged (PAW) |
|---|---|---|---|
| Web browsing | Allow most | Allow most | Deny by default, admin portals only |
| Email and productivity apps | Yes | Yes | No, on a separate device |
| User is local admin | Allowed | No | No |
| Application control (AppLocker) | None | Audit, then enforced | Enforced |
| BYOD enrollment | Allowed | Denied | Denied |

A PAW also relies on a hardware root of trust (TPM 2.0, Secure Boot, BitLocker) and Windows protections such as Credential Guard. The reason is the clean source principle: an admin session is only as trustworthy as the device it starts from, because an attacker who controls that device can steal the admin's tokens or act as them.

A PAW is not a jump server or bastion. A jump server is an intermediary that admins connect through; a PAW is the device they connect from, and a compromised laptop connecting to a perfect bastion still hands the attacker the session. The cost is real: admins need two devices or a separate hardened virtual environment, which is why many organizations limit PAWs to tier-zero roles (domain, identity provider and cloud tenant admins) and pair them with [device posture](https://startwithidentity.com/glossary/device-posture/) checks in [conditional access](https://startwithidentity.com/glossary/conditional-access/) so admin portals refuse sign-ins from anything else.

See also: [top privileged access workstations](https://startwithidentity.com/articles/top-5-privileged-access-workstations/), [PAM](https://startwithidentity.com/glossary/pam/), [session recording](https://startwithidentity.com/glossary/session-recording/), [privileged remote access](https://startwithidentity.com/glossary/privileged-remote-access/), [primary refresh token theft](https://startwithidentity.com/techniques/primary-refresh-token-theft/)