Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
The following sections of this article discuss frequently asked questions for Endpoint Privilege Management (EPM).
Frequently asked questions
Is my virtual device supported for onboarding to Endpoint Privilege Management?
Endpoint Privilege Management is supported with the following virtual devices:
- Azure Virtual Desktop single-session virtual machines (VMs), added in January 2026.
- Windows 365, added in September 2023.
Why is my elevation settings policy showing error/not applicable?
The elevation settings policy controls the enablement of EPM and the configuration of the client side components. When this policy is in error or shows not applicable, it indicates the device had an issue enabling EPM. The two most common reasons are missing the required Windows updates or failure to communicate with required Intune Endpoints for Endpoint Privilege Management.
What happens when someone with administrative privileges uses a device that is enabled for EPM?
Endpoint Privilege Management doesn't manage elevation requests by users that have administrative permissions on a device. If an administrator launches a file with a matching elevation rule, the application launches as it normally does for the administrator and is reported as an unmanaged elevation.
What files can be elevated to administrator?
Endpoint Privilege Management supports executable files with .exe .msi extensions and .ps1 PowerShell scripts.
Why doesn't 'Run with elevated access" show on start menu items?
Certain items that reside in the start menu or taskbar have a curated right-click menu and the EPM right-click context menu isn't able to be added to those menus. We plan to fix this issue in a future release.
Can I launch multiple files as elevated with the "Run with elevated access" right-click context menu?
Only one file can be elevated at a time. To launch multiple files elevated, right-click each file individually and select Run with elevated access.
What is the difference between Microsoft EPM and Windows Administrator protection?
EPM allows standard users to perform tasks that require elevated privileges without granting them full admin rights. Windows Administrator protection secures admin accounts from token theft.
Do I need additional licensing for EPM?
Yes, Endpoint Privilege Management requires specific licensing. For more information, see Microsoft Intune advanced capabilities.
How does EPM and Windows Defender Application Control (WDAC) differ?
EPM and WDAC compliment each other. EPM allows apps to elevate, while WDAC ensures only approved/blocked apps (elevated or not) can run.