No direct or indirect guarantee is given, and this cannot be considered official documentation. It’s up to you to integer this work into your security posture and evaluate impacts. I am not here to discuss if this document in any parts adhere to all principles and best practices of a secure administration environment, I just want to show a feature as a proof of concept.

Obtain above with a sort of simplicity and costs control.Connect to Domain Controller thorough RDP form the PAW using SSO (Single Sign On).Same credential can be used on prem and in cloud (if needed).Have only one identity with one strong credential.Have the ability to use multiple PAWs (privileged access workstation) with same MFA credential.Eradicate from the domain the password presence for those privileged accounts (make impossible to use a password to log on to domain to prevent some king of password attacks).Use that solution to protect privileged accounts passwords.Configure a modern MFA solution to access on prem Windows 10 PC.(Note the Microsoft Authenticator app will work without a mobile or Wi-Fi connection.I am here just to demonstrate that today is technically possible (Proof of Concept): We recommend you add an additional method to approve sign-ins in case you lose or cannot access your phone. Your web browser will now show this message. Your phone will then get a notification asking you to approve sign-in. Go back to your web browser and click 'Next' You can also control your notifications in your phone settings. Therefore we recommend clicking 'allow' for notifications. This is the quickest way to sign in to your account. The app can send a notification when you sign in asking you to approve it. If you have an iPhone, you will then be asked about notifications. You will then be able to continue the setup. Then enter the code and URL on the next screen. In the app click on 'Or enter code manually'. If you are looking at this on your phone you can click the code and URL to copy them. You will be given a code and URL to copy into the app. On your web browser click on 'Can't scan image?' under the QR code. If your phone is unable to recognise the QR code on your laptop screen it might be easier to start this process again using the web browser on your phone.

Ms mfa setup