Should I do admin work on a dedicated PAW?
A Privileged Access Workstation is a laptop that exists only for admin tasks. No mail, no browser sessions, no external USB. For SMBs a full PAW is often overkill, but the principle (admin tasks off your daily laptop) is sound from your first Global Admin.
Try this first
- 1Decide by role: Global Admin in Microsoft 365, local Domain Admin, and root on production should not run from your daily laptop. Definitely not from the laptop you also use for mail and browser.
- 2Light version: a separate browser profile (Edge or Chrome workspace) on the same laptop, no extensions, only for admin portals. Combined with a separate admin account that signs in only with a FIDO2 key.
- 3Stronger version: a separate VM or a Windows 365 Cloud PC with Intune compliance, only for admin work. No personal browser, no Outlook linked.
- 4Full PAW: a physical laptop dedicated to admin. No external USB, no personal browser, Conditional Access enforces admin tasks only from that device.
- 5Whatever you pick: keep break-glass accounts for emergencies, stored on a physical key in a safe, and test them every quarter.
When to bring us in
If you work in a sector with personal data at scale (healthcare, finance, recruitment) or have access to production OT, a real PAW is not a luxury but a baseline. A few hours of setup, prevents a career-defining incident.
See also
- I think I clicked a phishing linkNo shame, happens to everyone. The next fifteen minutes matter.
- A colleague's account is acting strangelySending mail in their name, rules hiding folders, unusual sign-ins. Suspicious.
- Lost the MFA app: new phone, no backup codesClassic problem after a phone upgrade. You are not the first to be locked out.
None of the above fits?
Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.
Or skip the DIY entirely
Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.