166: Endpoint Privilege Management (EPM)
Implementation Effort: Medium – Requires defining elevation rules, configuring support-approval workflows, and transitioning users from local admin to standard user accounts.
User Impact: Medium – Removes standing local administrator rights while allowing users to elevate approved applications seamlessly or via support approval.
Overview
Endpoint Privilege Management (EPM) allows organizations to enforce least privilege by running all users as standard users (without local administrator rights) while providing policy-controlled, just-in-time elevation for specific applications and tasks.
Key 2025–2026 updates to EPM include:
- Included in Microsoft 365 E5 (June 2026 / 2606): EPM is now included in Microsoft 365 E5 (in addition to the Microsoft Intune Suite), enabling broad enterprise adoption without a separate add-on license.
- Elevate as Current User (October 2025 / 2510): Elevation rules now support an Elevate as current user option (in addition to virtual account elevation). This runs the elevated process under the signed-in user's own account after requiring Windows Authentication (supporting MFA), preserving the user's profile paths, environment variables, and audit trail consistency.
- Expanded Support-Approved Elevations on Shared Devices (April 2026 / 2604): Support-approved file elevation requests are now supported from all users of a device, not just the primary or enrolling user—unlocking EPM for shared workstations.
- Azure Virtual Desktop (AVD) Support (February 2026 / 2601): EPM elevation policies now support deployment to users on AVD single-session virtual machines.
- EPM Readiness & Elevation Trends Dashboard (2510): Surfaces insights on managed vs. unmanaged elevations to identify which users are ready to transition from local admin to standard user.
- Scope Tag Enforcement & System Proxy Support (2511 / 2604): Enforces RBAC scope tags on EPM elevation requests and EPM reports, and supports telemetry reporting over system-level (
WinHTTP) proxies.