We're a medium-sized enterprise with many different IT administrators (e.g. domain admins, Azure admins, DB admins, ...). We're worried that hackers can easily breach an admin's laptop and through that steal data / do serious harm.
We thought about using VDI / jump server so that an admin would connect from his personal laptop to that remote machine and administer the network through that. However, it doesn't seem to really solve the problem as if an attacker owns the admin's personal laptop, he can simply control the remote machine. We also read about Privileged Access Workstations (PAW). While the approach seems safer, it's too cumbersome for our users and requires discipline.
What's the best (practical) way to protect IT administrators?