Is administrative access to servers restricted to a jump host or a limited number of endpoints?
The point of a jump host is that administrative credentials never touch a machine that reads email.
What the carrier is actually asking
The carrier is asking whether administrative access to servers is brokered through a hardened intermediary, or restricted to a small number of dedicated endpoints, rather than being available from any administrator workstation.
Why it is underwritten
Credential theft from an administrator's daily workstation is the standard escalation path. That machine browses the web and opens mail. Brokering administration through a hardened host, or a privileged access workstation, breaks the chain between phishing and domain compromise.
Where the answer lives in Microsoft 365, Entra ID, and Azure
In the cloud this is partly measurable. On-premises jump host design is attested.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Azure | Azure Bastion deployment and virtual machine public exposure | Administrative access brokered through Bastion rather than direct connections |
| Azure | Just-in-time access configuration | Management ports closed by default and opened for a limited window from a specified source |
| Entra ID | Conditional Access requiring a compliant device for administrative roles | The cloud equivalent of a privileged access workstation, restricting administration to known devices |
| On-premises | Jump host design, hardening, and access rules | A hardened host with no mail or browsing, and filtering that permits administration only from it. Attested |
| Monitoring | Session logging on the jump host | Administrative sessions logged, which makes the host an audit point as well as a control |
A jump host that exists alongside direct access is a convenience, not a control. The filtering that permits administration only from that host is what makes the design work, and it is the part most often missing.
What a defensible yes requires
- Administration is possible only from the broker or from designated endpoints.
- The broker is hardened and does not run mail or browsing.
- Cloud administration requires a compliant device.
- Sessions are logged.
- Break-glass access exists for when the broker is unavailable, and is monitored.
How this answer goes wrong
A jump host exists and administrators connect directly when it is inconvenient, because nothing prevents them. The control is present in the architecture and absent in practice, which a review of connection logs makes obvious.
Frequently asked
Is a privileged access workstation the same thing?
Similar intent, different mechanism. A dedicated hardened workstation for administration achieves the same separation and answers this question well.
Does this apply to cloud administration?
Yes, in the form of device requirements for privileged roles. Describe it that way rather than answering no because there is no jump box.
What if the jump host is unavailable?
Define a break-glass path with monitoring and after-the-fact review. Without one, people build their own and the control erodes.
Should sessions be recorded?
Useful for high-value environments and for service providers, and not required to answer this question yes.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture