Azure-only account

Intune-managed, non-domain-joined PAW

RDP with non-privileged hybrid account

AD-joined AVD

Tier 0 computer

T0 Computer & T0 Admin accounts protected by Authentication Policy

NON-PAW device

AD T0 account

Accounts, PAW and AVD logon protected by MFA, Conditional Access, Identity Protection etc.

Modern protection mechanisms applied: • Conditional Access Policy allowing access only from a compliant PAW device • Multifactor authentication • Identity protection