Endpoint Privilege Management (EPM) is a Microsoft Intune capability that removes the need for permanent local admin rights on Windows devices. It lets standard users elevate approved applications on demand, controlled by policies you define in the Intune admin center. EPM logs every elevation event, supports approval workflows, and uses an isolated virtual account to run elevated processes. It's part of the Intune Suite or available as a standalone add-on, and it targets the same problem that third-party tools like BeyondTrust and CyberArk solve: enforcing least privilege without killing user productivity.
Key takeaways
- EPM lets standard users run approved apps with elevated privileges without permanent admin rights.
- It requires the Microsoft Intune Suite or standalone EPM add-on license beyond Intune Plan 1.
- Elevated processes run under an isolated virtual account, not the user's own profile.
- Three elevation types are available: automatic, user-confirmed, and support-approved.
- EPM currently supports Windows only. macOS is not covered as of mid-2026.
Quick explanation
In simple terms
EPM is a tool in Microsoft Intune that lets regular users run specific programs as an administrator when IT approves it, without making them a full-time admin on their computer.
Technical definition
EPM is a policy-driven privilege elevation framework within Intune that intercepts UAC prompts for standard users, matches the target binary against centrally managed elevation rules (by file hash, certificate, or path), and proxies the execution through an isolated virtual account with admin context, logging all elevation metadata to Intune for audit and compliance.
Analogy
Think of EPM like a building's key card system. Instead of giving every employee a master key (local admin), you give them a card that only opens specific doors (approved apps) when they tap it. The system logs every door opened, and some doors need a security guard's approval first.
Definition
Endpoint Privilege Management (EPM) is a Microsoft Intune capability that lets standard users run specific approved applications or tasks with elevated privileges, without granting them permanent local administrator rights on their Windows devices.
Endpoint Privilege Management is part of the Microsoft Intune Suite (also available as a standalone add-on). It addresses a core Zero Trust challenge: users need admin-level access for certain tasks, like installing approved software or updating drivers, but giving them permanent local admin rights creates a large attack surface. EPM solves this by allowing IT admins to define elevation rules in Intune. When a standard user needs to run an approved application, they right-click and select 'Run with elevated access.' EPM temporarily elevates only that specific process using an isolated virtual account, logs the event to Intune, and optionally requires a business justification or admin approval before granting access.
Why it matters
Core concepts
Elevation Settings Policy
The foundational EPM policy that enables the EPM agent on a device, sets the default behavior for unmanaged elevation requests, and controls diagnostic data reporting.
The elevation settings policy is the first thing you deploy. It activates EPM on the device and defines what happens when a user tries to elevate a file that isn't covered by any elevation rule. Options include denying the request, prompting the user for confirmation, or requiring support approval. Per Microsoft Learn, devices must receive this policy before they can process any elevation rules.
Example
Setting the default response to 'Deny elevation' for unsigned files, while allowing 'Require support approval' for publisher-signed files.
Why it matters — Without an elevation settings policy, EPM doesn't activate. The default behavior also determines your security posture for edge cases not covered by specific rules.
Elevation Rules Policy
A policy that defines which specific applications or scripts can be elevated, under what conditions, and with which elevation type.
Elevation rules match target files using criteria like file name, file hash, certificate, or file path. Each rule specifies an elevation type: automatic (no user interaction), user-confirmed (user confirms intent), or support-approved (requires admin approval in the Intune portal). Rules can also require a business justification from the user before elevation proceeds.
Example
Creating a rule that allows 'setup.exe' signed by a specific publisher certificate to elevate automatically, while requiring support approval for any unknown installers.
Why it matters — Rules are the core mechanism that balances security with productivity. Overly broad rules weaken security, while overly restrictive rules drive helpdesk tickets.
Elevation Types
The three ways EPM can handle an elevation request: automatic, user-confirmed, and support-approved.
Automatic elevation runs the app with admin privileges immediately, with no user interaction. This suits trusted, frequently used applications. User-confirmed elevation prompts the user to confirm their intent and optionally provide a business justification. Support-approved elevation sends the request to an IT admin in the Intune portal, who reviews and approves or denies it. The user is notified once a decision is made.
Example
A driver update tool might use automatic elevation, a departmental LOB app might use user-confirmed, and an unfamiliar installer would use support-approved.
Why it matters — Choosing the right elevation type per application is the main design decision in an EPM deployment. It directly affects both security posture and user experience.
Virtual Account Isolation
EPM runs most elevated processes under an isolated virtual account rather than the user's own account, limiting the elevated process's access to user-specific data.
When EPM elevates a process, it doesn't add the user to the local administrators group. Instead, it creates a temporary virtual account with admin privileges to run that specific process. This isolation means the elevated process can't access the user's profile data, reducing the risk of privilege escalation or data exposure. The exception is the 'Elevate as current user' type, which runs under the user's own context when needed.
Example
An installer running under the virtual account can write to Program Files but can't read the user's Documents folder or browser profile.
Why it matters — Virtual account isolation is what makes EPM fundamentally different from simply granting local admin rights. It limits the blast radius of any elevated process.
Managed vs. Unmanaged Elevations
Managed elevations are those facilitated by EPM through rules or default settings. Unmanaged elevations are traditional admin elevations that bypass EPM entirely.
Intune's EPM reporting distinguishes between managed elevations (those EPM controlled) and unmanaged elevations (those that happen outside EPM, such as a user who still has local admin rights using a standard UAC prompt). Tracking both types helps identify gaps in your EPM coverage and users who still have unnecessary admin rights.
Example
If the elevation report shows unmanaged elevations from a specific device group, it means those users still have local admin rights that EPM isn't controlling.
Why it matters — Monitoring unmanaged elevations is how you measure the completeness of your EPM rollout and identify remaining local admin accounts to remove.
How it works
IT admin creates elevation policies in Intune
An administrator defines an elevation settings policy (which activates EPM and sets defaults) and one or more elevation rules policies (which specify which apps can elevate and how). These policies are deployed to user or device groups through Intune.
Policy creation
Example — Admin creates a rule allowing 'app-installer.exe' with a specific SHA-256 hash to elevate with user confirmation.
EPM agent provisions on the device
When a device receives the elevation settings policy, Intune automatically provisions the EPM client-side agent. No manual installation is required. The agent installs to C:\Program Files\Microsoft EPM Agent and begins enforcing the received policies.
Agent provisioning
Example — After policy sync, the EPM agent folder appears on the device and the 'Run with elevated access' context menu option becomes available.
User requests elevation
A standard user right-clicks an application and selects 'Run with elevated access.' The EPM agent intercepts this request and checks it against the deployed elevation rules.
Elevation request
Example — A user right-clicks a software installer and chooses 'Run with elevated access' instead of the standard 'Run as administrator' UAC prompt.
EPM evaluates the rule and processes the request
The agent matches the file against elevation rules by hash, certificate, or path. If a match is found, the configured elevation type determines the next action: automatic elevation, user confirmation prompt, or routing to admin approval. If no rule matches, the default elevation response from the settings policy applies.
Rule evaluation
Example — The file hash matches an automatic elevation rule, so EPM elevates the process immediately with no user prompt.
Process runs in elevated context and event is logged
EPM runs the approved process under an isolated virtual account with admin privileges. The elevation event, including file details, user identity, device, timestamp, and business justification (if required), is logged to Intune for audit and compliance reporting.
Execution and audit
Example — The installer runs successfully, and the elevation appears in the Intune Endpoint Privilege Management elevation report within 24 hours.
Use cases
Removing local admin from knowledge workers
IT administratorsReplace permanent admin rights with EPM rules for the 5-10 applications that actually need elevation, like LOB installers and driver updates.
A finance team that previously had local admin to install a tax reporting tool now uses EPM automatic elevation for that specific app.
Benefit — Eliminates the most common endpoint attack vector without increasing helpdesk tickets.
Controlled software installation for developers
IT administrators and developersDevelopers often need to install SDKs, runtimes, and tools. EPM lets them elevate approved development tools while blocking unknown installers.
A developer can install Visual Studio updates via automatic elevation but needs support approval for any unsigned executable.
Benefit — Maintains developer productivity while enforcing organizational security standards.
MSP multi-tenant least-privilege enforcement
Managed Service ProvidersMSPs can deploy EPM policies per tenant to standardize least-privilege posture across client environments.
An MSP deploys EPM across 50 client tenants, each with tailored elevation rules for their specific LOB applications.
Benefit — Consistent security posture across clients with centralized reporting.
Compliance evidence for audit
Security and compliance teamsEPM's elevation logging provides auditable evidence that least-privilege controls are enforced, supporting SOC 2, ISO 27001, and NIST compliance.
During an ISO 27001 audit, the organization exports EPM elevation reports to demonstrate that admin rights are controlled and logged.
Benefit — Ready-made audit trail for privilege management controls.
Benefits
Eliminates permanent local admin rights
Users run as standard users by default, removing the most exploited endpoint attack vector.
Malware executing under a standard user context can't install drivers, write to system directories, or disable security software.
Native integration with Intune
No separate console, agent deployment, or infrastructure required. EPM is managed entirely from the Intune admin center.
Policies, approvals, and reports all live in the same portal administrators already use for device management.
Granular elevation control
Rules can match applications by file hash, publisher certificate, or file path, with three distinct elevation types.
A high-confidence rule using SHA-256 hash for a critical LOB app, and a broad certificate-based rule for a trusted vendor's suite.
Complete audit trail
Every elevation event is logged with file details, user identity, device name, timestamp, and business justification.
The elevation report in Intune shows exactly who elevated what, when, and why, across the entire device fleet.
Limitations
Windows only
HighEPM does not support macOS, Linux, iOS, or Android as of mid-2026. Organizations with mixed-OS environments need a separate solution for non-Windows endpoints.
Workaround — Use a third-party PAM tool like BeyondTrust or CyberArk for macOS privilege management alongside EPM for Windows.
Requires additional licensing
MediumEPM is not included in Intune Plan 1. It requires either the Microsoft Intune Suite ($10/user/month) or the standalone EPM add-on ($3/user/month), on top of the base Intune license.
Workaround — Evaluate whether EPM alone justifies the cost, or whether the full Intune Suite bundle makes more sense for your organization.
Approval notifications depend on sync frequency
MediumSupport-approved elevations are routed to the Intune portal, but the user is notified only on the next device sync. This can take minutes to hours depending on sync settings.
Workaround — Force a manual sync on the device after submitting an approval request, or configure more frequent check-in intervals.
Reporting delay
LowElevation event data processes every 24 hours, so there's no real-time dashboard for elevation activity.
Workaround — Use Microsoft Defender for Endpoint Advanced Hunting with the AppElevationRequest action type for near-real-time visibility.
No built-in denial notification
LowWhen an admin denies a support-approved request, the user doesn't receive a pop-up notification. They must check back or be told separately.
Workaround — Establish a communication channel (email, Teams) for notifying users about denied requests.
Architecture
EPM uses a client-server architecture. Policies are authored and managed centrally in the Intune admin center. The EPM client agent, automatically provisioned on enrolled Windows devices, enforces these policies locally. Elevation events and approval requests flow back to Intune for centralized reporting and workflow management.
Intune Admin Center
Central policy authoring, deployment, approval workflow, and reporting interface for EPM.
Endpoint Security > Endpoint Privilege Management in the Intune portal.
EPM Client Agent
Client-side component that receives policies, intercepts elevation requests, evaluates rules, and enforces elevation behavior on the device.
Installed automatically at C:\Program Files\Microsoft EPM Agent when the device receives an elevation settings policy.
Elevation Settings Policy
Activates EPM on the device and defines default elevation behavior and reporting scope.
Default response set to 'Deny elevation' for unmanaged files.
Elevation Rules Policy
Defines per-application or per-script elevation behavior based on file identity (hash, certificate, path).
Rule matching 'app.exe' by SHA-256 hash with user-confirmed elevation type.
Virtual Account
Isolated account used by EPM to run elevated processes, separating admin context from the user's profile.
Installer writes to system paths but can't access user-specific data.
Elevation Reports
Centralized reporting in Intune showing managed and unmanaged elevation events with file, user, device, and timestamp metadata.
Elevation Report and Managed Elevation Report under Endpoint Privilege Management in Intune.
Data flow
Policy creation flows from Intune admin center to devices via Intune policy sync. Elevation requests are processed locally by the EPM agent. Elevation event telemetry flows back to Intune for reporting. Support-approved requests are routed to the Intune portal for admin action, and approval notifications are delivered to the device on the next sync.
Integrations: Microsoft Intune device management, Microsoft Entra ID (for device identity and join), Microsoft Defender for Endpoint (Advanced Hunting for EPM events), Intune reporting and compliance
Architecture limitations
Examples
Removing admin rights from a pilot group
An organization starts with a 50-user pilot group that currently has local admin rights.
IT deploys EPM in audit mode for 2-4 weeks, reviews the elevation report to identify which applications need rules, creates elevation rules for each one, then removes the pilot group from local administrators via Intune Account Protection policy.
Handling ad-hoc software requests
A marketing team member needs to install a one-time design tool not covered by existing rules.
The user right-clicks the installer and selects 'Run with elevated access.' Since no rule matches, the default elevation response (support-approved) routes the request to the Intune portal. The admin reviews the file details, approves the one-time elevation, and optionally creates a permanent rule for future requests.
Comparisons
EPM vs. BeyondTrust Privilege Management vs BeyondTrust Endpoint Privilege Management
BeyondTrust is a mature, cross-platform privilege management solution with deep policy flexibility. EPM is Microsoft's native, Intune-integrated alternative that covers Windows only but requires no additional infrastructure.
| Criterion | EPM vs. BeyondTrust Privilege Management | BeyondTrust Endpoint Privilege Management |
|---|---|---|
| Platform support | Windows only | Windows, macOS, Linux |
| Management console | Integrated in Intune admin center | Separate BeyondTrust console |
| Infrastructure | Cloud-native, no additional servers | Requires BeyondTrust infrastructure or SaaS |
| Licensing | Intune Suite or standalone add-on | Separate commercial license |
When to choose — EPM fits best for Intune-centric, Windows-only environments. BeyondTrust suits organizations needing cross-platform coverage or more advanced policy controls.
EPM vs. Windows LAPS vs Windows Local Administrator Password Solution (LAPS)
LAPS manages the local admin account password, while EPM removes the need for users to have admin rights entirely. They solve different problems and complement each other.
| Criterion | EPM vs. Windows LAPS | Windows Local Administrator Password Solution (LAPS) |
|---|---|---|
| Purpose | Lets standard users elevate approved apps | Rotates and secures the local admin account password |
| User experience | Users right-click to elevate specific apps | Users don't interact with LAPS directly |
| Attack surface reduction | Removes permanent admin rights from users | Prevents lateral movement via shared admin passwords |
When to choose — Deploy both: EPM for user-facing least privilege, LAPS for securing the emergency local admin account.
Myths, corrected
Myth
EPM gives users temporary admin rights
Correction
EPM doesn't add users to the local administrators group. It runs the elevated process under an isolated virtual account. The user never actually becomes an admin.
Why it happens: People conflate 'elevated privileges' with 'admin account.' EPM elevates the process, not the user.
Myth
EPM replaces the need for LAPS
Correction
EPM and LAPS address different risks. EPM controls user-initiated elevation. LAPS secures the local admin account password for break-glass scenarios. Both should be deployed together.
Why it happens: Both relate to local admin management, so they're often confused as alternatives.
Myth
EPM is included with Intune Plan 1
Correction
EPM requires either the Microsoft Intune Suite or a standalone EPM add-on license, both of which are additional to Intune Plan 1. Microsoft has announced some Intune Suite capabilities may be included in M365 E3/E5 later in 2026, but as of mid-2026, EPM remains an add-on.
Why it happens: Intune Plan 1 is bundled with many Microsoft 365 licenses, leading to the assumption that all Intune features are included.
Myth
EPM works on macOS
Correction
EPM is Windows-only as of mid-2026. Microsoft does not offer EPM for macOS. Organizations need a third-party tool for macOS privilege management.
Why it happens: Intune manages macOS devices, so people assume all Intune security features extend to macOS.
Practical implications
For admins
Plan for a phased rollout: deploy EPM in audit mode first to identify which applications need elevation rules before removing local admin rights. The elevation report in Intune is your primary tool for building the initial rule set. Expect 2-4 weeks of audit before moving to enforcement.
For MSPs
EPM can standardize least-privilege posture across client tenants. Create template elevation rules for common LOB applications and adapt per client. Factor the Intune Suite or EPM add-on license cost into your per-seat pricing.
For business
EPM directly reduces the risk of ransomware and lateral movement by eliminating permanent admin rights. It supports compliance requirements (SOC 2, ISO 27001, NIST) with built-in audit trails. The trade-off is additional licensing cost and the effort to build and maintain elevation rules.
For security
EPM aligns with Zero Trust least-privilege principles. Combine it with Conditional Access policies and Microsoft Defender for Endpoint for a layered security model. Use Defender Advanced Hunting to query EPM elevation events in near-real-time.
For end users
Users right-click approved apps and select 'Run with elevated access' instead of calling the helpdesk. For support-approved requests, they provide a business justification and wait for admin approval. The experience is smoother than logging a ticket, but the approval delay (depending on sync frequency) can be a friction point.
Cost impact
The Intune Suite costs $10/user/month; the standalone EPM add-on costs approximately $3/user/month. Both are on top of the base Intune Plan 1 license. Weigh this against helpdesk ticket reduction and reduced incident response costs from compromised admin accounts.
Operational impact
Initial deployment requires effort to build the elevation rule set during the audit phase. Ongoing maintenance involves reviewing approval requests and updating rules as new applications are deployed. The elevation report simplifies this, but it's not zero-touch.
Decision guide
Use when
- Your organization uses Microsoft Intune to manage Windows endpoints
- You want to remove local admin rights from standard users
- You need a native, cloud-managed least-privilege solution without additional infrastructure
- You need auditable elevation logs for compliance (SOC 2, ISO 27001, NIST)
Avoid when
- You need cross-platform privilege management (macOS, Linux)
- You need real-time elevation monitoring (EPM reports process daily)
- You don't use Intune for device management
- You need full PAM capabilities for server and infrastructure access
Requirements
- Microsoft Intune Plan 1 (base)
- Intune Suite or standalone EPM add-on license
- Windows 10 version 2004 or later, or Windows 11
- Microsoft Entra ID joined or hybrid joined devices
- Intune enrollment (or Configuration Manager co-management)
Alternatives
- BeyondTrust Endpoint Privilege Management (cross-platform, mature)
- CyberArk Endpoint Privilege Manager (enterprise PAM integration)
- Windows LAPS (complementary, not a replacement)
- Manual UAC management with Group Policy (limited, no audit trail)
Related terms
The principle that users and processes should operate with the minimum permissions necessary to perform their tasks.
A security model that assumes no implicit trust based on network location, requiring continuous verification for every access request.
Windows Local Administrator Password Solution, which automatically rotates and secures the local admin account password on managed devices.
A premium bundle of advanced Intune capabilities including EPM, Remote Help, Advanced Analytics, Cloud PKI, and Enterprise App Management.
User Account Control (UAC)
A Windows security mechanism that prompts for consent or credentials when an application requires elevated privileges.
Frequently asked questions
Is Endpoint Privilege Management included with Microsoft 365 E5?
As of mid-2026, EPM is not included with Microsoft 365 E5 by default. It requires the Intune Suite add-on or a standalone EPM license. Microsoft has announced plans to include some Intune Suite capabilities in M365 E3/E5 later in 2026, but the rollout timeline hasn't been confirmed.
Does EPM work on macOS devices?
No. EPM is Windows-only as of mid-2026. Microsoft does not offer EPM for macOS. Organizations needing macOS privilege management should evaluate third-party tools like BeyondTrust or CyberArk.
What happens when a user tries to elevate an app without a matching rule?
The default elevation response from the elevation settings policy applies. This can be configured to deny the request, prompt the user for confirmation, or require support approval. If no elevation settings policy is deployed, EPM rejects the request by default.
Does EPM give users local admin rights?
No. EPM elevates individual processes using an isolated virtual account. The user is never added to the local administrators group. Only the specific approved process runs with admin context.
How long does it take for a support-approved elevation to reach the user?
The approval notification is delivered to the device during the next Intune policy sync. Sync frequency varies, but you can force an immediate sync from the Company Portal app or by running the PushLaunch scheduled task.
Can EPM replace third-party privilege management tools?
For Windows-only environments managed by Intune, EPM can replace most third-party endpoint privilege management tools. However, organizations with cross-platform needs (macOS, Linux) or complex PAM requirements for server infrastructure may still need a third-party solution alongside or instead of EPM.
What reporting does EPM provide?
EPM provides two main reports in Intune: the Elevation Report (all reported elevations) and the Managed Elevation Report (elevations handled by specific rules). Both include file name, user, device, result, and timestamp. Data processes every 24 hours. For near-real-time queries, use Microsoft Defender for Endpoint Advanced Hunting with the AppElevationRequest action type.
Conclusion
Endpoint Privilege Management is Microsoft's native answer to the least-privilege problem on Windows endpoints. It removes permanent local admin rights, replaces them with policy-controlled on-demand elevation, and logs everything to Intune for audit. The licensing requires an Intune Suite subscription or standalone add-on, it's Windows-only, and reporting has a 24-hour delay. But for Intune-managed Windows environments, it eliminates the need for a separate third-party tool and integrates directly into the admin workflow you already use.
Main takeaway
If you're planning an EPM deployment, start with Microsoft's official planning guide on Microsoft Learn, then run an audit-mode pilot to build your elevation rule set before removing local admin rights.
