Endpoint Privilege Management: Support-Approved Elevations in Intune

Endpoint Privilege Management (EPM) lets standard users run specific, approved apps and files with elevation — without local admin rights. This guide covers the support-approved flow: the user requests elevation, a helpdesk/admin approves it in Intune, and the app then runs elevated.

Two policy types work together: an elevation settings policy (turns EPM on and sets default behavior) and an elevation rules policy (defines which files can elevate and how).

• Licensing: EPM is part of the Intune Suite add-on and is included with Microsoft 365 E5 — verify your tenant entitlements
• Devices enrolled in Intune (or co-managed) on a supported Windows version
• Network line-of-sight to the required EPM endpoints (no SSL inspection breakage)
• The Intune Administrator role to configure policies and approve requests

1. Go to Endpoint security > Endpoint privilege management > Policies and select Create policy.
2. Platform: Windows — Profile: Elevation settings policy.
3. Configure: Endpoint Privilege Management = Enabled; Default elevation response = Require support approval; Allow elevation detection = Yes; Send elevation data for reporting = Yes.
4. Assign to the target users/devices and select Create.

Devices must receive a settings policy that enables EPM before any elevation rules take effect.

1. Create a second policy with profile Elevation rules policy.
2. Add a rule via Edit instance and define the file as specifically as possible: file name/path, publisher, hash or certificate.
3. Set elevation behavior (automatic or user-confirmed) and require business justification.
4. Assign to the same groups as the settings policy.

The more attributes you match, the harder a rule is to abuse — avoid broad wildcards like *.exe.

The user right-clicks the app and chooses Run with elevated access, enters a business justification, and sends the request. It appears under Endpoint security > Endpoint privilege management > Elevation requests.

1. Open Elevation requests.
2. Review the app, user, device and justification.
3. Approve or deny the request.

After approval, the user runs the app again and it launches with elevated rights for that approved file. If you deny the request, the app stays blocked.

1. On a test device with a standard user, elevate an approved app.
2. Confirm the request appears in Elevation requests.
3. Approve it and confirm the app runs elevated.
4. Check Endpoint security > Endpoint privilege management > Reports for the recorded event.

Confirm the settings policy (with EPM enabled) reached the device first, and both policies target the same users/devices.

Check device connectivity to the required endpoints and that elevation data reporting is enabled.

Prefer file hash or publisher + path + name over broad wildcards.

• Endpoint Privilege Management — Microsoft Learn
• Configure support-approved EPM elevation — Anoop C Nair