When to use a PAW machine

Hi all,

we are working on giving some IT admins Privileged Access Workstations (PAW machines) for when they do admin work.

Looking at this https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-devices I am unsure what roles in Entra ID might be justifiable for the "privileged access" tier 0. We were thinking all entra ID roles that are tagged as "privileged".

I am keen to hear form people who do use PAW machines and what roles in Entra ID is mapped to the security levels mentioned in Microsoft article https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-security-levels