--- title: "Is administrative access to servers restricted to a jump host or a limited number of endpoints?" url: https://insuranceposture.com/questions/network-and-logging/administrative-access-servers-restricted-jump-host-limited-number-endpoints category: "Network, logging and monitoring" canonical_key: q_net_016 evidence_state: partial updated: 2026-08-24 --- # Is administrative access to servers restricted to a jump host or a limited number of endpoints? URL: https://insuranceposture.com/questions/network-and-logging/administrative-access-servers-restricted-jump-host-limited-number-endpoints Section: Network, logging and monitoring Evidence state: Partly verifiable from your tenant The point of a jump host is that administrative credentials never touch a machine that reads email. ## What the carrier is actually asking The carrier is asking whether administrative access to servers is brokered through a hardened intermediary, or restricted to a small number of dedicated endpoints, rather than being available from any administrator workstation. ## Why it is underwritten Credential theft from an administrator's daily workstation is the standard escalation path. That machine browses the web and opens mail. Brokering administration through a hardened host, or a privileged access workstation, breaks the chain between phishing and domain compromise. ## Where the answer lives in Microsoft 365, Entra ID, and Azure In the cloud this is partly measurable. On-premises jump host design is attested. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Azure | Azure Bastion deployment and virtual machine public exposure | Administrative access brokered through Bastion rather than direct connections | | Azure | Just-in-time access configuration | Management ports closed by default and opened for a limited window from a specified source | | Entra ID | Conditional Access requiring a compliant device for administrative roles | The cloud equivalent of a privileged access workstation, restricting administration to known devices | | On-premises | Jump host design, hardening, and access rules | A hardened host with no mail or browsing, and filtering that permits administration only from it. Attested | | Monitoring | Session logging on the jump host | Administrative sessions logged, which makes the host an audit point as well as a control | **The jump host has to be the only path** A jump host that exists alongside direct access is a convenience, not a control. The filtering that permits administration only from that host is what makes the design work, and it is the part most often missing. ## What a defensible yes requires - Administration is possible only from the broker or from designated endpoints. - The broker is hardened and does not run mail or browsing. - Cloud administration requires a compliant device. - Sessions are logged. - Break-glass access exists for when the broker is unavailable, and is monitored. ## How this answer goes wrong A jump host exists and administrators connect directly when it is inconvenient, because nothing prevents them. The control is present in the architecture and absent in practice, which a review of connection logs makes obvious. ## If this answer turns out to be wrong Remote access exposure and log retention are what a forensic report describes first, which makes them the answers most often revisited after a loss. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how an application answer ends in a denied claim](https://insuranceposture.com/glossary/claim-denial). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Is a privileged access workstation the same thing? Similar intent, different mechanism. A dedicated hardened workstation for administration achieves the same separation and answers this question well. ### Does this apply to cloud administration? Yes, in the form of device requirements for privileged roles. Describe it that way rather than answering no because there is no jump box. ### What if the jump host is unavailable? Define a break-glass path with monitoring and after-the-fact review. Without one, people build their own and the control erodes. ### Should sessions be recorded? Useful for high-value environments and for service providers, and not required to answer this question yes. ## Related questions - [Does the Applicant utilize a Privileged Access Management (PAM) tool?](https://insuranceposture.com/questions/access-control/applicant-utilize-privileged-access-management-tool) - [Are administrative/management login portals restricted from the public internet (closed or limited to specific IP addresses)?](https://insuranceposture.com/questions/network-and-logging/administrative-management-login-portals-restricted-from-public-internet) - [Is MFA enforced on all privileged / administrative user accounts?](https://insuranceposture.com/questions/multi-factor-authentication/mfa-enforced-privileged-administrative-user-accounts) - [Is RDP enabled, and if so, accessible internally only or externally?](https://insuranceposture.com/questions/network-and-logging/rdp-enabled-accessible-internally-only-externally) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.