One of the most persistent challenges in enterprise endpoint management is the tension between security and productivity. Historically, IT departments either granted users full Local Administrator rights (resulting in rampant malware infections and configuration drift) or strictly enforced Standard User rights (resulting in endless helpdesk tickets when users needed to install authorized software or modify legacy applications). To resolve this fundamental conflict, organizations are adopting Zero Trust architectures that emphasize the Principle of Least Privilege. Microsoft Intune Endpoint Privilege Management (EPM) facilitates this by allowing administrators to seamlessly grant standard users Just-in-Time (JIT), scoped elevation rights for specific, pre-approved executables without ever providing the user with a local administrator credential.
Understanding Endpoint Privilege Management (EPM)
Intune EPM operates via a robust, kernel-level agent deployed to managed Windows 10 and Windows 11 devices. When a user attempts to launch an executable that requires administrative rights (e.g., a legacy line-of-business application or an authorized MSI installer), they do not receive the standard, blocking User Account Control (UAC) prompt asking for IT credentials.
Instead, if the executable matches a cryptographic signature defined in an Intune EPM Elevation Rule, the user receives a specialized EPM prompt. Depending on the administrator’s configuration, the user can either elevate the application silently, or they may be required to provide a business justification (which is logged for auditing) and re-authenticate via Windows Hello for Business before the process launches with a specialized, isolated administrative token.
Configuring the EPM Global Settings Profile
Before deploying specific elevation rules, you must deploy a foundational EPM settings profile to your endpoints to define the baseline client behavior.
- Navigate to the Microsoft Intune admin center.
- Select Endpoint security > Endpoint Privilege Management.
- Click Create profile.
- Select Windows 10 and later as the platform and Elevation settings as the profile type.
- Configure the core parameters:
- Enable Endpoint Privilege Management: Set to Yes. This automatically deploys the EPM client agent to targeted devices.
- Default elevation response: Set to
Deny all requests. This enforces a strict default-deny posture for any executable not explicitly allowed by a subsequent rule. - Telemetry and Reporting: Enable diagnostic data collection so you can audit elevation events centrally within Intune.
Assign this baseline profile to your pilot group of devices or users.
Authoring an EPM Elevation Rule
With the client agent deployed, you must author specific rules authorizing the elevation of legitimate software. For maximum security, rules should never rely on simple file names or paths, which are trivial for attackers to spoof. Instead, rules should utilize cryptographic file hashes or publisher certificates.
Let us create a rule to allow standard users to elevate the installation of an authorized VPN client.
- In the Intune admin center, under Endpoint Privilege Management, click Create profile.
- Select the Elevation rules profile type.
- Define the rule parameters:
- Rule name: Allow VPN Client Installation
- Elevation type: Select
User confirmed. This requires the user to explicitly acknowledge the elevation, reducing accidental launches. - Validation: Select
Business justification. This forces the user to type a reason, which is logged to the Intune reporting dashboard.
- Define the file detection logic. Under File information, you must provide the precise cryptographic details of the executable.
- File hash: Input the exact SHA-256 hash of the VPN installer executable.
- Certificate publisher: (Optional but highly recommended) Input the Subject Name of the code-signing certificate used by the vendor to sign the binary.
The End-User Experience and Auditing
Once the Elevation Rule synchronizes to the Windows endpoint, the user experience is transformed. When the standard user right-clicks the authorized VPN installer, they will see a new context menu option injected by the EPM agent: Run with elevated access.
Upon clicking this option, the custom EPM dialog appears, prompting for the required business justification. Once submitted, the application launches with the necessary administrative token, allowing the installation to proceed seamlessly. The user’s underlying Windows account remains a Standard User, completely insulating the wider operating system from compromise.
Simultaneously, the EPM agent securely transmits the elevation telemetry back to Microsoft Intune. Administrators can navigate to Endpoint security > Endpoint Privilege Management > Elevation report to audit exactly who elevated the application, the device it occurred on, and the business justification provided, ensuring strict compliance with enterprise governance mandates.