Endpoint Privilege Management (EPM) Policies

Allow standard Windows users to run approved administrative tools and installers with just-in-time elevated privileges without granting full local administrator rights.

Tags:#EPM#Least Privilege#Elevation Rules#Endpoint Security#Intune Suite#MD-102

Overview

Microsoft Intune Endpoint Privilege Management (EPM) allows organizations to run all users as Standard Users (least privilege) while enabling controlled, audited, just-in-time elevation of specific approved applications, diagnostic tools, and administrative tasks.

With EPM, users can right-click an approved application and select Run with elevated access. The elevation occurs seamlessly based on policy rules (Automatic elevation vs User-confirmed with business justification vs Support-approved elevation).

---

When to Use

Scenario	Recommendation	Technical Rationale
Developer / Engineer Tools (VS Code, Wireshark)	Automatic / Justification Elevation	Allows engineers to run developer tools needing admin rights without making them local admins on the OS.
Approved Printer & Network Diagnostic Scripts	Automatic Elevation	Eliminates Helpdesk support tickets for basic approved routine admin utilities.
Unapproved Executables	Deny by Default	Blocks unknown binaries from triggering UAC elevation prompts.

---

Prerequisites

Licenses: Microsoft Intune Suite add-on or standalone Endpoint Privilege Management license.
Client OS: Windows 11 (22H2+) or Windows 10 (20H2+) with current cumulative updates.
Agent: Intune Management Extension installs the EPM client components automatically upon policy assignment.

---

Portal Path

TEXT

Microsoft Intune Admin Center (https://intune.microsoft.com)
└── Endpoint security
    └── Endpoint Privilege Management
        ├── Windows elevation settings policy
        └── Windows elevation rules policy

---

Step-by-Step Implementation

Step 1: Enable EPM via Elevation Settings Policy

Go to Endpoint security > Endpoint Privilege Management > Create Policy.
Profile: Elevation settings policy.
Set Enable Endpoint Privilege Management: Yes.
Set Send elevation data for reporting: Yes (stores audit logs in Intune).

Step 2: Create Elevation Rules Policy

In EPM > Create Policy > Profile: Elevation rules policy.
Click + Add rule and configure:

Rule name: Elevate-Approved-ProcMon
Elevation type: User confirmed (Requires user to enter a business justification reason before elevation proceeds)
File name: Procmon64.exe
File path: C:\Program Files\Sysinternals\Procmon64.exe
Certificate type: Publisher (Matches Sysinternals / Microsoft code signing cert) or File Hash (SHA-256 hash).

Assign to: SG-Corporate-Developers.

---

PowerShell Commands

Check EPM Client Engine & Elevation Service Status:

PowerShell

# Verify Microsoft EPM Elevation Service is running
Get-Service -Name "EpmElevationService" | Select-Object Name, Status, StartType

# Read local EPM operational event logs
Get-WinEvent -LogName "Microsoft-Windows-EndpointPrivilegeManagement/Operational" -MaxEvents 5 | 
    Select-Object TimeCreated, Id, Message | Format-List

---

Troubleshooting Matrix

Issue	Root Cause	Resolution
Elevation Fails / Blocked	Hash or Certificate mismatch; the application was updated by vendor and the binary hash changed.	Use Publisher Certificate matching rather than static SHA-256 hashes to prevent breaking apps upon minor version updates.
EPM Option Missing from Right-Click	Shell extension not registered, or device has not received the base Elevation Settings policy.	Run an Intune device sync and inspect `IntuneManagementExtension.log` for EPM agent deployment status.

---

MD-102 Exam Notes

Exam Blueprint & High-Yield Traps

Key Exam Traps:

The three Elevation Types in EPM are:

Automatic: Elevates silently without user prompt.
User confirmed: Prompts user for justification or authentication before elevating.
Support approved: Requires an IT admin approval request in the Intune portal before the user can execute.

EPM requires the Microsoft Intune Suite or standalone EPM license.

PREVIOUS TOPIC4.1 Settings Catalog & Administrative Templates (ADMX)NEXT TOPIC4.3 Windows Update for Business: Update Rings & Policies