🔐 Endpoint Privilege Management (EPM)

📋 Overview & Licensing

Endpoint Privilege Management (EPM) allows standard users to elevate specific applications without requiring permanent local admin rights. Every elevation request is logged, auditable and policy-controlled via Intune.

Licensing Requirements

🏗️ Architecture

EPM is built on top of Intune's MDM channel and leverages the Intune Management Extension (IME) on Windows endpoints. Policy enforcement is done via a kernel-level component.

✅ Prerequisites

⚙️ Elevation Settings Policy

The Elevation Settings Policy is the master policy that enables EPM and controls global behavior. Intune → Endpoint Security → Endpoint Privilege Management → Policies → Elevation Settings

🎚️ Elevation Types

📜 Elevation Rules

Intune → Endpoint Security → Endpoint Privilege Management → Policies → Elevation Rules

Rule Identification Methods

Example: Creating an Elevation Rule

POST https://graph.microsoft.com/beta/deviceManagement/privilegeManagementElevations

{
  "displayName": "Acrobat Installer – User Confirmed",
  "description": "Allow Adobe Acrobat installer to elevate with user confirmation",
  "elevationType": "userConfirmed",
  "childProcessBehavior": "allowAll",
  "productName": "AcroRd32 Setup",
  "publisher": "Adobe Inc.",
  "fileName": "AcroRdrDCx64Setup.exe",
  "fileHash": "sha256:abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890"
}

# Get SHA-256 hash of an executable
Get-FileHash -Path "C:\Downloads\AcroRdrDCx64Setup.exe" -Algorithm SHA256

# Output:
# Algorithm  Hash                                                              Path
# ---------  ----                                                              ----
# SHA256     A1B2C3D4E5F6...                                                   C:\Downloads\...

# Get Publisher Certificate details:
$sig = Get-AuthenticodeSignature -FilePath "C:\Downloads\AcroRdrDCx64Setup.exe"
$sig.SignerCertificate | Select-Object Subject, Issuer, NotAfter
# Use Subject for Publisher field in Intune rule

🎫 Support-Approved Elevation Flow

Help Desk Approval Process

# Help Desk: Intune → Endpoint Security → EPM → Elevation Requests
# Filter: Status = Pending
# Review: User, App, Justification, Device
# Actions: Approve (generates 6-digit code) or Deny (with reason)

# Approved token expiry: 60 minutes (configurable in Elevation Settings Policy)
# One-time use: Token can only be used once
# Audit: All approvals/denials logged in Intune Reports

📊 Reports & Monitoring

⭐ Best Practices

🔧 Troubleshooting

# Check IME version and EPM status on endpoint:
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\IntuneManagementExtension" | Select-Object Version, AgentExecutor

# Check EPM policy applied:
Get-WinEvent -LogName "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin" |
  Where-Object {$_.Message -like "*PrivilegeManagement*"} | Select-Object -Last 20

# IME Log – EPM events:
Get-Content "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log" -Tail 100 |
  Where-Object {$_ -match "EPM|ElevationRule|Privilege"}

💻 PowerShell & Graph API

Connect-MgGraph -Scopes "DeviceManagementConfiguration.Read.All"

# Get all EPM elevation events (last 7 days):
$since = (Get-Date).AddDays(-7).ToString("o")
$elevations = Invoke-MgGraphRequest -Method GET `
  -Uri "https://graph.microsoft.com/beta/deviceManagement/privilegeManagementElevations?`$filter=requestCreatedDateTime ge $since"

# Summary by elevation type:
$elevations.value | Group-Object elevationType |
  Select-Object @{N="Type";E={$_.Name}}, Count | Format-Table

# Top elevated apps:
$elevations.value | Group-Object fileName |
  Sort-Object Count -Descending | Select-Object -First 10 |
  Select-Object @{N="App";E={$_.Name}}, Count | Format-Table

# List all EPM elevation rules:
$rules = Invoke-MgGraphRequest -Method GET `
  -Uri "https://graph.microsoft.com/beta/deviceManagement/privilegeManagementElevations/rules"
$rules.value | Select-Object displayName, elevationType, publisher, fileName | Format-Table

# Export rules to JSON for backup:
$rules.value | ConvertTo-Json -Depth 10 |
  Out-File "C:\Backup\EPM-Rules-$(Get-Date -Format yyyyMMdd).json"

# Get pending Support Approved requests:
$requests = Invoke-MgGraphRequest -Method GET `
  -Uri "https://graph.microsoft.com/beta/deviceManagement/privilegeManagementElevations/requests?`$filter=status eq 'pending'"
$requests.value | Select-Object requestId, requestorUserPrincipalName, applicationName, justification | Format-Table

# Approve a request:
Invoke-MgGraphRequest -Method POST `
  -Uri "https://graph.microsoft.com/beta/deviceManagement/privilegeManagementElevations/requests/$requestId/approve" `
  -Body '{"reviewComment":"Approved for one-time use – valid 60 minutes"}'

✅ Deployment Checklist

• 📦 Licensing & Prerequisites
• EPM license (Intune Suite or Add-on) assigned to all target users
• Devices enrolled in Intune MDM
• IME version ≥ 1.43.203.0 on all endpoints
• ⚙️ Policy Configuration
• Elevation Settings Policy created and assigned
• Default Elevation Response = Report-Only (pilot) → Deny All (production)
• Support Approved expiry set (60 minutes recommended)
• 📜 Elevation Rules
• All known elevation apps have rules with Publisher + Hash
• No File Path-only rules in production
• Dangerous apps have explicit Deny rules
• 👥 Rollout
• Local Administrators group emptied via Configuration Policy
• Pilot group (IT team) validated for 2 weeks
• User communication and training completed
• Help Desk trained on Support-Approved workflow
• 📊 Monitoring
• Unmanaged Elevation Report reviewed weekly
• EPM Report exported monthly for compliance
• Rules reviewed and updated quarterly