Why does Endpoint Privilege Management (EPM) with Microsoft Intune send elevation data for reporting noncompliance?

Eric Goh Kheng Poo 0

I am using Endpoint Privilege Management (EPM) with Microsoft Intune. I have a Microsoft E5 license and an additional Intune Suite license. I started applying the elevation settings for EPM and sent elevation data for reporting noncompliance. My device status in Microsoft Intune shows as compliant, with ownership under corporate. I am using Windows 11 Enterprise, version 24H2. All prerequisites are fulfilled, but EPM is still not running. I have been troubleshooting this issue for a month now.

Rudy Ooms 611 Reputation points MVP

2024-11-25T08:14:01.5466667+00:00

Hi, i assume the epm agent doesnt show up on the device ? Could you check out Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments*guidintuneenrllment*\LinkedEnrollment if there is an error code in there?

Also..how did you enrolled the device into Intune ? As for example mdm only could give you some issues running epm as i am explaining here: https://call4cloud.nl/mdm-only-enrollment-epm-0x8018000b/
Eric Goh Kheng Poo 0 Reputation points

2024-11-26T03:17:51.74+00:00

Hi Rudy Ooms,

You are correct, the EPM agent does not show up on the device. I checked the registry path you mentioned Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollmentsguidintuneenrollment\LinkedEnrollment), and no error codes appear inside the folder.

We are not using hybrid joined Intune. Our devices are enrolled as Organization-owned devices with MDM. Specifically, we use the "Corporate-owned, fully managed user device" enrollment method. This method ensures that devices are fully managed by Intune and provides comprehensive control over device settings and policies.

Additionally, we have verified that the MDM authority is correctly set to Intune, and all necessary configurations for device compliance and configuration profiles are in place. Despite this, the EPM agent still does not appear on the devices.

Thank you for your assistance and suggestions.
Rudy Ooms 611 Reputation points MVP

2024-11-27T05:47:51.64+00:00

Could you sent a screenshot of that content? or tell me what it mentions? dus it show you a different GUID? (the linked enrollment) does that one shows you anything?
Eric Goh Kheng Poo 0 Reputation points

2024-11-27T08:27:10.4233333+00:00

Sorry! I couldn’t locate the path Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments\{GUID}\IntuneEnrollment\LinkedEnrollment
Rudy Ooms 611 Reputation points MVP

2024-11-27T08:29:56.71+00:00

Mmm.. well that sounds as if the device is not getting the linked enrollment which is a requirement for epm: i am explaining the flow and the troubleshooting step (and how to trigger it on your own) right here: https://call4cloud.nl/epm-enrollment-mmpc-mmp-c/
Eric Goh Kheng Poo 0 Reputation points

2024-11-29T02:26:03.0566667+00:00

Hi Rudy!

Thanks for your advice. I have read your article about MMP-C here. https://call4cloud.nl/when-does-a-device-sync-with-mmp-c/ You mentioned that " if we purchase the Intune Suite, all of our devices will automatically get onboarded to MMP-C and will be linked/dual enrolled". We have used the Intune Suite and assigned licenses to users. Endpoint users should be able to install and see the linkedEnrollment folder, but we can't see it. Does this mean we need to install it manually? It doesn't make sense.

1 answer

Xenia-MSFT 2,840 Reputation points Microsoft Vendor

2024-11-27T05:45:07.96+00:00

@Eric Goh Kheng Poo Thanks for posting in our Q&A.

For this issue, we appreciate your help to collect some information:

1.Did you deploy both EPM Elevation settings policy & Elevation Rule policy? If yes, please make sure that you set "Endpoint Privilege Management" to "enable" in EPM Elevation settings policy.

2.Open Event Viewer, navigate to Applications and Service Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider and search for "mmp-c" match in all events. One of the events should include the error enrolling the device to MMPC (Microsoft Managed Platform Cloud).

If there is anything update, feel free to let us know.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Eric Goh Kheng Poo 0 Reputation points

2024-11-27T08:19:06.9466667+00:00

Yes, Endpoint Privilege Management Enabled

I wasn’t able to find MMP-C

Eric Goh Kheng Poo 0 Reputation points

2024-11-27T08:30:55.61+00:00

Yes, Endpoint Privilege Management

i couldn't find MMP-C

Eric Goh Kheng Poo 0 Reputation points

2024-11-27T08:58:02.55+00:00

yes. Endpoint Privilege Management Enable

i couldn't find mmp-c

Xenia-MSFT 2,840 Reputation points Microsoft Vendor

2024-11-28T02:15:52.65+00:00

@Eric Goh Kheng Poo Please refer to the link that Rudy Ooms provided to troubleshoot.

https://call4cloud.nl/epm-enrollment-mmpc-mmp-c/

Note: Non-Microsoft link, just for the reference.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Why does Endpoint Privilege Management (EPM) with Microsoft Intune send elevation data for reporting noncompliance?

1 answer

Your answer