Hardware-based Privileged Access Workstations remain the gold standard, with supply chain control, dedicated devices, and physical isolation. But not every organization can deploy PAW hardware across every scenario, and the ones that can rarely cover every admin who needs one. This is the design we landed on for the gaps.

Using Windows 365 Frontline in shared mode, every privileged session starts on a freshly provisioned Cloud PC and is destroyed on logoff. No persistent state, no leftover artifacts, no lateral movement from a compromised session. Internet access is locked down and connectivity to privileged resources runs through Global Secure Access, so the Cloud PC reaches exactly what it needs and nothing else.

We walk the full architecture as it was actually deployed: the Conditional Access policy set that gates access, the device filter that separates PAW sessions from the rest of the tenant, and the reprovisioning trigger that automates teardown. Live provisioning, a planted artifact that does not survive the rebuild, and a look at what the logs show when a session reaches for something outside its profile.

The parts that did not go smoothly get equal airtime. Where Frontline shared mode licensing forces design decisions you would not otherwise make, what breaks when admins expect persistence, and the failure modes worth knowing before Tier 0 goes anywhere near this. Plus the honest comparison against hardware PAWs, including the scenarios where the supply chain argument still wins and you should not use this at all.

For identity and endpoint architects who own privileged access and need something deployable for the cases hardware cannot cover.