Skip to content

Endpoint Privilege Management

Users with local administrator rights can install anything, disable security tools and help malware spread. Endpoint Privilege Management (EPM) lets you take those rights away while still letting people run the specific things they need as administrator.

EPM is included in Microsoft 365 E5 and E7 from July 2026, and is available with the Intune Suite or as a standalone add-on. Manage it under Endpoint security > Endpoint Privilege Management.

How it works

When EPM is active on a device, users get a Run with elevated access option on the right-click menu. When they use it (or launch a file covered by an automatic rule), EPM checks your rules:

flowchart TD
    A[User requests elevation] --> B{Matching rule?}
    B -->|Deny rule| X[Blocked]
    B -->|Automatic| E[Elevates silently]
    B -->|User confirmed| C[User confirms, optionally<br/>with justification or Windows sign-in]
    B -->|Support approved| S[Request goes to admins<br/>for approval]
    B -->|No rule| D{Default elevation response}
    D -->|Deny all requests| X
    D -->|Require support approval| S
    D -->|Require user confirmation| C
    C --> E
    S -->|Approved| E

Except for Elevate as current user, EPM runs elevated processes under a temporary virtual account, which keeps the elevated process away from the user's profile and data.

The two policies

Policy What it does
Windows elevation settings policy Turns EPM on for the device, sets the default elevation response for files with no rule, and sets what data is reported. It's device-scoped, even if assigned to a user group.
Windows elevation rules policy Lists the files that can be elevated and how: by file name, hash, publisher certificate, path and arguments, with an elevation type for each.

Supported file types are .exe, .msi and .ps1.

Elevation types

Type Behavior Use for
Automatic Elevates silently, with no prompt Trusted tools that must run elevated routinely. Requires a file hash. Use sparingly.
User confirmed User confirms, optionally with a business justification, Windows authentication, or both Most rules
Elevate as current user Runs under the user's own account with Windows authentication Only for apps that break under the virtual account, because it exposes the user's profile
Support approved User submits a request; an admin approves it in the admin center Occasional, unplanned needs
Deny Blocks elevation of the file Tools you never want elevated

When several rules match

EPM resolves overlapping rules in this order:

  1. Deny rules always win.
  2. Rules assigned to the user beat rules assigned to the device.
  3. Rules with a file hash are the most specific.
  4. Otherwise, the rule with the most attributes wins.
  5. If there's still a tie: User confirmed, then Elevate as current user, then Support approved, then Automatic.
  1. Turn on EPM with reporting. Create an elevation settings policy with EPM enabled, the default response set to Deny all requests or Require support approval, and reporting of all endpoint elevations. Assign it to a pilot group that still has admin rights.
  2. Learn what people elevate. After a few weeks, use the Elevation report to see which files users run as administrator.
  3. Create rules from the report. EPM can create rules straight from report entries and from support-approved requests.
  4. Remove admin rights for the pilot group. Use an Account protection local user group membership policy to control the Administrators group, and Windows LAPS for the built-in admin account.
  5. Expand in rings, watching support-approved requests for rules you've missed.

Security recommendations from Microsoft

  • Make the default response Deny all requests or Require support approval, not Require user confirmation.
  • Give every rule a file path in a location standard users can't write to, such as C:\Program Files. Never use network share paths.
  • Be strict with installers versus runtime elevation, and with high-risk tools like browsers and PowerShell. For PowerShell, prefer rules for specific signed scripts.
  • If you're migrating from a third-party privilege tool, start fresh with audit and reports instead of translating old rules one for one.

Beyond files: system settings

EPM can also let standard users change specific system settings, starting with network settings (IPv4, IPv6 and DNS), through an elevation system settings policy. Users reach the allowed settings from Company Portal, with user confirmation and optional justification.

Learn more