メインコンテンツへスキップ

166: Endpoint Privilege Management (EPM)

Implementation Effort: Medium – Requires defining elevation rules, configuring support-approval workflows, and transitioning users from local admin to standard user accounts.

User Impact: Medium – Removes standing local administrator rights while allowing users to elevate approved applications seamlessly or via support approval.

Overview​

Endpoint Privilege Management (EPM) allows organizations to enforce least privilege by running all users as standard users (without local administrator rights) while providing policy-controlled, just-in-time elevation for specific applications and tasks.

Key 2025–2026 updates to EPM include:

  • Included in Microsoft 365 E5 (June 2026 / 2606): EPM is now included in Microsoft 365 E5 (in addition to the Microsoft Intune Suite), enabling broad enterprise adoption without a separate add-on license.
  • Elevate as Current User (October 2025 / 2510): Elevation rules now support an Elevate as current user option (in addition to virtual account elevation). This runs the elevated process under the signed-in user's own account after requiring Windows Authentication (supporting MFA), preserving the user's profile paths, environment variables, and audit trail consistency.
  • Expanded Support-Approved Elevations on Shared Devices (April 2026 / 2604): Support-approved file elevation requests are now supported from all users of a device, not just the primary or enrolling user—unlocking EPM for shared workstations.
  • Azure Virtual Desktop (AVD) Support (February 2026 / 2601): EPM elevation policies now support deployment to users on AVD single-session virtual machines.
  • EPM Readiness & Elevation Trends Dashboard (2510): Surfaces insights on managed vs. unmanaged elevations to identify which users are ready to transition from local admin to standard user.
  • Scope Tag Enforcement & System Proxy Support (2511 / 2604): Enforces RBAC scope tags on EPM elevation requests and EPM reports, and supports telemetry reporting over system-level (WinHTTP) proxies.

Implementation Guidance​

Define the least-privilege target state​

  • Identify which users still have local admin rights, which tasks truly require elevation, and which apps should be remediated instead of permanently excepted.
  • Decide whether elevations should be automatic for trusted rules, user-approved with justification, or handled by support staff through a separate process.
  • Review licensing and device support requirements before planning deployment beyond a pilot population.

Configure EPM in Intune​

  • Deploy the EPM client settings and create elevation rules that are as specific as possible, using publisher, file hash, path, or other supported attributes.
  • Prefer narrowly scoped rules for approved installers, management tools, or update workflows instead of broad path-based allow rules.
  • Pilot with users who frequently need admin actions so support can validate prompt behavior, success rates, and audit detail.

Operate and review elevation activity​

  • Review elevation reports and justifications regularly to identify apps that should be packaged differently or workflows that can be redesigned.
  • Expire temporary exceptions and remove unused rules so the EPM rule set does not grow into a shadow admin model.
  • Coordinate EPM with Windows LAPS, local admin removal, and helpdesk procedures so the operating model stays consistent.

Reference​