162: Account & Administrator Protection
Implementation Effort: Low – Configured through Intune Endpoint Security Account Protection profiles and Settings Catalog.
User Impact: Low to Medium – Transparent for standard tasks; when Administrator Protection is enabled, users must authenticate with Windows Hello (biometrics/PIN) for just-in-time elevation prompts.
Overview
Account protection in Microsoft Intune's Endpoint Security node protects user identities, credentials, and local administrator privileges on Windows devices. It encompasses:
- Windows Hello for Business (WHfB): Replaces passwords with strong, hardware-backed two-factor authentication using biometrics or PINs.
- Credential Guard: Uses virtualization-based security (VBS) to isolate and protect secrets and credentials from theft.
- Administrator Protection on Windows 11 (2026 Update): Adds two new settings to the Endpoint Security Account Protection profile (User Account Control Type Of Admin Approval Mode and User Account Control Behavior Of The Elevation Prompt For Administrator Protection). Administrator Protection enforces true least privilege by keeping users in a standard user token and generating a profile-isolated, just-in-time admin token only after interactive user authentication (such as Windows Hello) for each administrator-level action—preventing silent malware privilege escalation.
- Local User Group Membership: Controls members of built-in local groups (such as
Administrators) to strip standing local admin rights.
This supports Use least privilege access and Verify explicitly by eliminating standing administrative tokens and requiring explicit biometric/PIN verification for every elevation.