Getting started with Endpoint Privilege Management

This week is another post about one of the new Intune Suite add-on capabilities. This time it’s all about Endpoint Privilege Management (EPM). At this moment EPM is still in preview, but once it becomes general available it will be licensed as part of the Microsoft Intune Suite. EPM enables organizations to provide standard user permissions to their users and still enable those users to complete tasks that require elevated permissions. Those tasks can include the installation of applications, updating device drivers, running diagnostics, and more. With that, EPM fits perfectly in the Zero Trust architecture of any organization. It enables the principle of using the least privilege, while still allowing users to run specifically approved tasks with elevated permissions. So, users remain productive and elevations are audited. This post will start with a brief introduction about EPM, followed with the different activities to get EPM up-and-running. This post ends with the user experience.

Important: EPM is free for using during the preview period. After that period, it becomes a licensed product as part of the Intune Suite, or as a standalone product. In both cases, it’s on top of Microsoft Intune Plan 1.

Introducing Endpoint Privilege Management

Before looking at the implementation of EPM, it’s important to be familiar with the product and the different configuration components. EPM is directly integrated into Microsoft Intune and completely configurable via Microsoft Intune admin center. After activating the configuration of EPM, the configuration of EPM contains two major parts.

• Elevation settings – The elevation settings are the starting point of EPM on Windows devices. Those settings are configured via an Elevation settings policy. That policy enables the IT administrator to enable EPM on the targeted devices and to configure the default elevation behavior on those devices. Besides that, it can be used for configuring the reporting behavior of elevations on those devices.
• Elevation rules – The elevation rules are the link between an application and an elevation action in EPM. Those rules are configured via an Elevation rules policy. That policy enables the IT administrator to configure the elevation behavior for specifically specified applications within the environment.

After enabling EPM via the elevation settings, the EPM agent will be installed on the device. Once the EPM agent is in place, it’s important to understand the difference between managed and unmanaged elevations. A managed elevation is any elevation that is facilitated by EPM and an unmanaged elevation is any elevation that happens without EPM. That can be the case when using the Windows default action of Run as administrator. In either case, however, the result will be same, the file will be started with full administrative permissions on the device.

Of course, EPM provides IT with a lot more control, but it’s still important to keep in mind what the effect and impact will be of any rule created for the EPM agent. Often it can also be useful to have multiple elevation rules in place, which potentially can conflict with each other. When that’s the case it’s important to remember the following logic:

1. User takes precedence above device: Rules deployed to users take precedence over rules deployed to devices
2. Most specific takes precedence: Rules with a hash defined are deemed most specific and take precedence, followed with the rule that has the most attributes defined
3. Elevation behavior determines precedence: Rules with the elevation behavior of User Confirmed take precedence over rules with Support Approved, which takes precedence over rules with Automatic

Note: With conflicting elevation settings, the EPM client reverts to the default behavior until the conflict is resolved.

Enabling Endpoint Privilege Management

For using EPM, it first must be enabled for the tenant. To enable EPM for the tenant, follow the next two steps.

1. Open the Microsoft Intune admin center portal navigate to Endpoint security > Endpoint Privilege Management
2. On the Activate Endpoint Privilege Management for your tenant now page, review information and click Activate

Creating Windows elevation settings policy

After enabling EPM for the tenant, the next step is to deploy an Elevation settings policy. That policy is used to enable EPM on the device, to set the default behavior for elevation requests for any file that isn’t managed by an EPM elevation rule, and to configure the information that EPM reports back. That also means that a device must have an Elevation settings policy assigned, to enable EPM and it’s functionality. The following eight steps walk through the configuration of that policy.

1. Open the Microsoft Intune admin center portal navigate to Endpoint security > Endpoint Privilege Management
2. On the Policies tab of the Endpoint security | Endpoint Privilege Management page, click Create Policy
3. On the Create a profile page, provide the following information and click Create

• Platform: Select Windows 10 and later as value
• Profile: Select Elevation settings policy as value

4. On the Basics page, specify a valid name to distinguish the policy from other similar policies and click Next
5. On the Configuration settings page, as shown below in Figure 1, provide at least the following information and click Next

• With Endpoint Privilege Management switch the slider to Yes to enable EPM
  • Send data to Microsoft: Choose between Yes or No, to have the device send diagnostic data or information about file elevations to Intune.
    • Reporting scope: Choose between Diagnostic data and all endpoint elevations (that reports diagnostic data and details about all file elevations), Diagnostic data and managed elevations only (that reports diagnostic data and details about file elevations for only those that are managed by an elevation rule), and Diagnostic data only (that reports only diagnostic data) to configure what type of information a device reports to Intune
  • Default elevation response: Choose between Not configured (that functions the same as deny all), Deny all requests (that denies the elevation request), and Require user confirmation (that allows the elevation request and can prompt for validation) to configure how the device manages elevation requests for files that aren’t directly managed by a rule

6. On the Scope tags page, configure the required scope tags and click Next
7. On the Assignments page, configure the required assignment by selecting the applicable group and click Next
8. On the Create + Review page, review the configuration and click Create

Note: On a Windows device, the assigned elevation settings policy will be available as a DAT-file in C:\Program Files\Microsoft EPM Agent\Policies\ClientSettings. That file is readable like a JSON-file. Besides that, a reference is stamped in the registry at HKLM\SOFTWARE\Microsoft\EPMAgent\Policies\ClientSettings.

Creating Windows elevation rules policy

After enabling EPM on the device, the next step is to deploy an Elevation rules policy. That policy can be used to deploy one or more rules for files that are managed for elevation by EPM. Each rule of this policy identifies a file to manage elevation requests for, and specifies the elevation type of the file. That means that a device doesn’t need to have an Elevation rules policy assigned, as it specific to the files in the environment. The following eight steps walk through the configuration of that policy for an example application (Visual Studio Code) based on the hash of the file.

1. Open the Microsoft Intune admin center portal navigate to Endpoint security > Endpoint Privilege Management
2. On the Policies tab of the Endpoint security | Endpoint Privilege Management page, click Create Policy
3. On the Create a profile page, provide the following information and click Create

• Platform: Select Windows 10 and later as value
• Profile: Select Elevation rules policy as value

4. On the Basics page, specify a valid name to distinguish the policy from other similar policies and click Next
5. On the Configuration settings page, as shown below in Figure 2 and Figure 3, add a new rule, provide at least the following information and click Next

• Rule name: Specify a valid and unique name to distinguish the rule
• Elevation type: Choose between User confirmed (that prompts the user to confirm their intent to run the file) and Automatic (that automatically runs with elevated permissions), to configure the elevation type:
  • Validation: Select Business justification (that requires the user to enter a justification for running the file) and/or Windows authentication (that requires requires the user to authenticate using organization credentials)

• File name (2): Specify the name of the file and the extension
• Signature source (1): Choose Not configured, to not use a certificate to validate the integrity of the file
• File hash (3): Specify the hash of the file

Note: Use Get-FileHash, or the Endpoint elevation report (when using the reporting scope of Diagnostic data and all endpoint elevations) to easily retrieve the hash information of the file.

Note: Specify more details, to make sure that only the intended file can be used with elevated permissions.

6. On the Scope tags page, configure the required scope tags and click Next
7. On the Assignments page, configure the required assignment by selecting the applicable group and click Next
8. On the Create + Review page, review the configuration and click Create

Note: On a Windows device, the assigned elevation rules policy will be available as a DAT-file in C:\Program Files\Microsoft EPM Agent\Policies\ElevationRules. That file is readable like a JSON-file. Besides that, a reference is stamped in the registry at HKLM\SOFTWARE\Microsoft\EPMAgent\Policies\ElevationRules.

Experiencing running with elevated access

After enabling EPM and deploying specific elevation rules, it’s time to have a closer look at the user experience. The great part is that the experience is really straight forward. Once you’re familiar with it. Especially on devices running Windows 11. That’s because the option to run a file with elevated permissions is a bit hidden in the right-click context menu. The user must first click Show more options, before Run with elevated access becomes available. When the user has to provide a business justification, an experience as shown below in Figure 4 will be shown to the user.

Note: When the file was downloaded from the Internet, make sure to unblock it before using the elevation.

When the user also has to provide a Windows authentication, the experience will continue as shown below in Figure 5.

For verifying the configuration on a Windows device, it’s possible to look at the locations that were mentioned with the different elevation policies. Those locations provide the DAT-files with the applied configuration. Besides that, there is also the EpmPolicySpy.exe tool (in the EpmTools folder) that can be used to verify the applied policies.

More information

For more information about Endpoint Privilege Management, refer to the following docs.

• Learn about using Endpoint Privilege Management with Microsoft Intune | Microsoft Learn
• Guidance for creating elevation rules with Endpoint Privilege Management | Microsoft Learn
• Configure policies to manage Endpoint Privilege Management with Microsoft Intune | Microsoft Learn
• Monitor your Endpoint Privilege Management policies for Microsoft Intune | Microsoft Learn
• Review the data that Endpoint Privilege Management collects when used with Microsoft Intune | Microsoft Learn
• Deployment considerations for Endpoint Privilege Management | Microsoft Learn