How to Configure Microsoft Intune Endpoint Privilege Management (EPM) for Just-in-Time Admin Access

The single most effective security control a Microsoft Windows enterprise can implement is the removal of persistent Local Administrator rights. If a user operates as a Standard User, the blast radius of a ransomware infection or a phishing payload is mathematically confined to their specific user profile, preventing system-wide compromise. However, removing admin rights frequently paralyzes productivity. Developers need to install unauthorized software, IT staff need to update drivers, and legacy applications often require elevation to function. To bridge this gap without violating Zero Trust, Microsoft introduced Intune Endpoint Privilege Management (EPM). This solution completely eliminates standing admin privileges, replacing them with mathematically scoped, Just-In-Time (JIT) elevation policies managed entirely from the cloud.

The Architecture of Endpoint Privilege Management

Intune EPM operates by decoupling the user’s identity from the process’s execution context.

When EPM is deployed, all users operate as Standard Users. When a user attempts to execute a protected file (e.g., an .exe, .msi, or a PowerShell script), the EPM agent intercepts the execution request at the Windows kernel level. It then consults a local, cryptographically signed policy database synchronized from Microsoft Intune.

If the file matches a predefined elevation rule, the EPM agent dynamically creates a virtual, ephemeral administrative token, injects it into the process execution thread, and allows the software to install. The user never possesses the administrative password, and the elevation is strictly confined to that single process. Once the application closes, the elevated token is immediately destroyed.

Configuring EPM Elevation Rules

The core of EPM is the Elevation Rule profile. This dictates exactly which files are permitted to elevate.

1. Log in to the Microsoft Intune admin center.
2. Navigate to Endpoint security > Endpoint Privilege Management.
3. Create a new Elevation rule policy.
4. You must define the target application utilizing extremely rigid cryptographic identifiers to prevent malware from spoofing a legitimate application name.

For example, if you want to allow developers to install Visual Studio Code, you should not simply authorize CodeSetup.exe. Instead, you must authorize the Certificate Signature.

• Extract the digital certificate from the official Microsoft installer.
• Upload the certificate into Intune.
• Configure the rule to elevate any executable signed by this specific certificate, provided the internal file name matches CodeSetup.exe.

Configuring Support Approved Elevation (Just-In-Time)

While static rules are excellent for known applications (like printer drivers or approved IDEs), users inevitably need to install unknown, one-off software. This is where Support Approved elevation (JIT) becomes critical.

In your EPM Default Elevation Settings policy, you can configure the default behavior for unknown applications to Require Support Approval.

The workflow is entirely cloud-native:

1. The Standard User right-clicks an unknown installer (e.g., a highly specific CAD plugin) and selects Run with elevated access.
2. A native Windows dialog appears. The user types a business justification (e.g., “Required for the architectural rendering project”) and clicks Submit.
3. The request is instantly routed to the Intune admin center.
4. An IT administrator, possessing the Endpoint Privilege Management Approval role, logs into the portal, reviews the request (which includes the file name, the file hash, and the user’s justification), and clicks Approve.
5. Within seconds, the Intune agent on the user’s endpoint receives the cryptographic approval token, and the application silently installs with administrative rights.

This Just-In-Time architecture ensures that no user ever holds a persistent Local Admin password, while still maintaining the agility required to support dynamic enterprise workflows. Every single elevation event (whether automatically approved by a rule or manually approved by support) is logged in Intune, providing a mathematically perfect audit trail for security compliance.