Why Abandon Permanent Local Administrator Accounts
In many organizations, IT teams grant local administrator rights to users to meet one-time needs: installing a business application, updating a driver, running a diagnostic tool. This practice creates a significant attack surface and directly contradicts the least privilege (Least Privilege Access) principle, a cornerstone of any Zero Trust strategy.
Endpoint Privilege Management (EPM), integrated into Microsoft Intune, addresses this challenge. It allows users to function as standard accounts and obtain privilege elevation only for explicitly authorized applications or actions, in a controlled and audited manner.
The concrete benefits are as follows:
- Removal of permanent local administrator rights on Windows computers
- Targeted elevation for specific executables or actions
- IT validation workflow for elevations not covered by a rule
- Complete traceability of each request and elevation granted
- Strengthening of Zero Trust posture without degrading user experience
Technical Prerequisites and Licenses
Before any deployment, several conditions must be met.
Required licenses — EPM is not included in basic Intune offerings. The feature is available with:
- Microsoft Intune Suite
- Microsoft Intune Plan 2
- A standalone Endpoint Privilege Management license
License Compliance Point
Verify your subscription model before configuring EPM. Activating the service on a device without a valid license will block the deployment of elevation rules.
Workstation environment:
- Windows 10 or Windows 11 in a version officially supported by Microsoft
- Devices enrolled in Intune and joined via Microsoft Entra joined or Microsoft Entra hybrid joined
These prerequisites condition the receipt of EPM policies, audit event reporting, and consistent application of rules across your fleet.
EPM Solution Architecture
EPM is based on two configuration layers in Intune:
- Elevation Settings policy — Activates the EPM service on targeted devices and defines default behavior for elevations not covered by a rule.
- Elevation Rules policy — Defines precise rules per application (path, hash, publisher certificate) to automatically allow or block an elevation.
This article covers implementing the Elevation Settings policy, the mandatory entry point for any EPM deployment.
Configure the Elevation Settings Policy in Intune
Access the Endpoint Privilege Management section
In the Microsoft Intune portal (intune.microsoft.com), navigate to Endpoint Security > Endpoint Privilege Management, then click on Policies.
Create a new policy
Click on Create policy. Select Windows as the platform, then choose the Elevation Settings policy profile. Give the policy an explicit name, for example EPM - Elevation Settings - Pilot.
Enable the EPM service
In the Configuration settings section, enable the Endpoint Privilege Management parameter. This action triggers automatic deployment of EPM components on targeted devices.
Configure default behavior (Default Elevation Response)
The Default elevation response parameter determines what happens when a user attempts to run an application for which no EPM rule exists. Three options are available:
- Deny all requests: any elevation request not covered by a rule is denied.
- Require support approval: the user submits a request; an IT administrator must approve it before execution. Recommended option for pilot projects.
- Require user confirmation: the user can self-elevate after providing business justification and/or authenticating via Windows Authentication.
For an initial deployment, choose Require support approval to maintain control over each unplanned elevation.
Configure reporting
Enable collection of elevation events, including managed elevations and diagnostic information. This level of reporting is essential in the pilot phase to map applications regularly requiring elevated privileges and feed future EPM rules.
Assign the policy to a pilot group
Assign the policy to a Microsoft Entra group containing a restricted sample of users or Windows devices. Validate the configuration and create the policy.
Deployment Best Practice
Always start with a pilot group of 10 to 20 devices. Analyze reporting data for two to four weeks before expanding scope and creating specific elevation rules.
Key Parameters of the Elevation Settings Policy
| Parameter | Value | Impact |
|---|---|---|
| Endpoint Privilege Management | Enabled | Deploys EPM components on the device |
| Default elevation response | Require support approval | Any elevation outside rules goes through IT validation |
| Default elevation response | Require user confirmation | User self-elevates with justification or authentication |
| Default elevation response | Deny all requests | Complete blocking of elevations not covered by a rule |
| Reporting scope | Managed elevations + diagnostics | Complete reporting for audit and rule refinement |
User Experience: Installation Scenario with IT Validation
Here is the concrete journey of a standard user wanting to install the Brave browser on their Windows computer.
The user downloads the Brave installer. When they attempt to run it, Windows detects the required elevation. Thanks to EPM, a new option appears in the context menu:
Right-click on the installation file > Run with Elevated Access
An EPM window appears. Since no specific rule exists for Brave, the Default elevation response policy applies — here, Require support approval. The user provides business justification, then submits their request.
On the administrator side, the request appears in Endpoint Security > Endpoint Privilege Management > Elevation requests tab, with Pending status. The administrator reviews the justification, verifies that Brave is authorized in the company, then clicks Approve while adding a validation comment.
The user receives a Windows notification indicating their request is approved. They right-click again > Run with Elevated Access. EPM temporarily grants the necessary privileges to only the installation process. Once installation is complete, elevated privileges are automatically revoked.
Temporary and Targeted Elevation
EPM never grants global administrator rights on the computer. The elevation is limited to the relevant process and the operation duration. The user remains a standard account after each elevation.
Audit and Reporting of Elevations
All elevation requests, whether approved, denied, or self-validated, are recorded in Intune. The reported data includes:
- The identity of the user submitting the request
- The name and path of the relevant executable
- The business justification entered
- The decision made (approved, denied) and the identity of the administrator who decided
- The timestamp of each step
These events feed EPM reports available in the Intune portal and can be exported to Microsoft Sentinel or any other SIEM via Intune diagnostic connectors for correlation with other security signals.
Limitations and Points of Attention Before Deployment
- EPM does not replace an Elevation Rules policy: without specific rules per application, each out-of-scope installation generates a manual request, which can overwhelm the IT team in production.
- Devices not enrolled in Intune do not receive any EPM policy. Workgroup computers or those managed only by GPO are not compatible.
- The feature is separate from Windows LAPS (Local Administrator Password Solution): the two solutions are complementary but address different needs.
- Test UAC behavior on your critical business applications before a wide deployment: some legacy applications handle token-based elevations poorly compared to account-based ones.
Do Not Remove Local Admins Without EPM Rules in Place
Removing local administrator rights from a user without having previously deployed and validated EPM elevation rules will block legitimate usage. Always proceed in phases: active EPM pilot, map requirements, create rules, then remove rights.
