What Is Endpoint Privilege Management in Microsoft 365 in 2026? What Has Changed?
One of the simplest ways to improve Windows security is also one of the most frequently avoided:
Stop giving everyone local administrator rights.
Permanent local admin access is convenient. Employees can install applications, update specialist software, change system settings and run tools without contacting IT.
Unfortunately, malware can potentially benefit from that same level of privilege.
The better approach is least privilege: employees work as standard users and only receive elevated permissions for specific tasks when those permissions are actually required.
That is exactly what Microsoft Intune Endpoint Privilege Management, usually shortened to EPM, is designed to do.
And there have been some important changes in 2026 — including new elevation behaviour, better support for shared computers, improved reporting and, significantly, changes to Microsoft 365 licensing.
What Is Microsoft Endpoint Privilege Management?
Endpoint Privilege Management is an advanced Microsoft Intune capability that allows employees to remain standard Windows users while still carrying out approved tasks requiring administrator permissions.
Instead of making somebody a permanent local administrator, IT can allow a particular installer, application or PowerShell script to elevate when necessary.
Microsoft positions EPM as part of a least-privilege and Zero Trust approach. Its current documentation describes standard users as the default, with just-in-time elevation provided for approved binaries or scripts.
For example, an engineer might need administrative rights to update specialist design software.
Without EPM, you might:
Give them permanent administrator rights.
Provide an administrator password.
Or ask IT to remotely connect every time the application needs updating.
EPM creates another option:
Allow the authorised updater to elevate, while the user remains a standard user for everything else.
Why Is Permanent Local Administrator Access a Problem?
Administrator rights provide extensive control over Windows.
Depending on the environment, a local administrator may be able to:
Install software.
Run privileged scripts.
Modify system settings.
Install drivers.
Create or alter accounts.
Disable security features.
Make changes affecting other users.
That is useful when legitimate administration is required.
It is considerably less useful when the process requesting those permissions happens to be malicious.
Removing standing administrator privileges does not make malware impossible, but it can reduce the amount of damage a compromised user or malicious process can cause.
Microsoft's current EPM design specifically aims to let organisations remove persistent admin access without making employees completely dependent on IT for legitimate elevation requirements.
How Does Endpoint Privilege Management Work?
EPM is managed through the Microsoft Intune admin centre.
Microsoft currently divides the configuration into two main policy areas:
Elevation settings policies, which configure the EPM client, reporting and default elevation behaviour.
Elevation rules policies, which determine what specific binaries or scripts are allowed to elevate and under which conditions.
When EPM is enabled, the client components are automatically deployed to supported Windows devices through policy.
Rules can be built using attributes including file paths, hashes and publisher certificates, and Microsoft also supports controls over child processes and command-line arguments.
Currently supported elevation targets include:
.exe executable files
.msi Windows Installer packages
.ps1 PowerShell scripts
That provides much more precision than simply saying:
“This user can be an administrator.”
The Different Types of Elevation
EPM supports several approaches depending on the application and the amount of control required.
Automatic elevation
A known application can be elevated automatically when it matches a defined rule.
This can create a very smooth user experience, but automatic rules should be narrow and carefully tested. Microsoft warns that overly broad automatic elevation rules can have significant security consequences.
User-confirmed elevation
The user can select Run with elevated access and then complete whatever validation the organisation requires.
That can include Windows authentication, a business justification or both.
Support-approved elevation
The employee requests elevation and an authorised IT administrator reviews it before allowing the application to run.
This can work well for software that is legitimate but is not used frequently enough to justify a permanent automatic elevation rule.
Deny
EPM can explicitly prevent known files from running with elevated privileges.
What's Changed in Endpoint Privilege Management in 2026?
This is where the existing article particularly needed updating.
Microsoft has made several meaningful changes.
1. Microsoft 365 E5 Now Includes Endpoint Privilege Management
This is probably the biggest commercial change.
From 1 July 2026, Microsoft added several advanced Intune capabilities directly into Microsoft 365 enterprise licensing.
Microsoft 365 E3 gained capabilities including Remote Help, Advanced Analytics and Intune Plan 2.
Microsoft 365 E5 gained those features plus Endpoint Privilege Management, Enterprise Application Management and Microsoft Cloud PKI. Microsoft 365 E7 also includes these advanced capabilities.
That changes the EPM conversation considerably for organisations already licensing Microsoft 365 E5.
Previously, many businesses needed a separate EPM licence or Intune Suite subscription.
Now, organisations on Microsoft 365 E5 may already have the entitlement.
If you're paying for E5 but still giving employees permanent local administrator rights, it is therefore worth reviewing whether EPM can now help you reduce that exposure without an additional EPM licence.
What about Microsoft 365 E3?
E3 now includes several more advanced Intune capabilities, but EPM itself is not one of the additional E3 inclusions.
For organisations on other qualifying plans, the Intune Suite and individual advanced capabilities remain available through applicable licensing options.
Microsoft licensing changes frequently enough that organisations should check their actual tenant entitlements before buying anything.
2. EPM Now Supports “Elevate as Current User”
Most EPM elevation methods use a virtual account.
This is an important security feature because it separates the elevated process from the signed-in employee's ordinary user profile.
However, some applications do not work properly that way.
They may depend on:
User profile paths.
Environment variables.
User-specific preferences.
Or other resources associated with the logged-in account.
Microsoft now provides an Elevate as current user option for those compatibility scenarios. The application receives elevation while remaining within the signed-in user's context.
There is a trade-off.
Because the elevated process has access to the user's full context, Microsoft says this creates a broader attack surface and less isolation than the virtual-account model.
Microsoft therefore recommends using the virtual-account elevation approach where compatibility allows it, and reserving current-user elevation for applications that genuinely require it.
That is important.
The new option should not become:
“Everything works more easily this way, so let's use it for everything.”
Use it where necessary.
Not everywhere.
3. Support Approval Works Better on Shared Devices
Another useful 2026 improvement arrived with Intune service release 2604.
Support-approved elevation requests can now be submitted by all users of a device.
Previously, this workflow was limited to the device's primary user or the person who enrolled the machine.
That makes EPM more practical in shared-device scenarios.
Think about:
Workshop machines.
Shared engineering computers.
Training-room devices.
Reception PCs.
Shift-based environments.
Several different employees may use the same endpoint, but you still want controlled privilege elevation rather than giving the device unrestricted local administrator rights.
4. Better Reporting Helps Identify Who Still Needs Admin Rights
EPM reporting has also become more useful.
Microsoft now provides an EPM Overview dashboard designed partly to show an organisation's readiness to move users from local administrator accounts to standard-user operation.
It can highlight users who have:
Only unmanaged elevations.
Both managed and unmanaged elevations.
Only managed EPM elevations.
It can also surface frequently unmanaged applications, commonly approved support requests and frequently denied elevations.
That changes how businesses can approach deployment.
Rather than guessing which employees need admin rights, you can increasingly use actual elevation activity to answer:
What are people using administrator rights for?
Which applications really need elevation?
Can we create an EPM rule for them?
Which users are now ready to have permanent admin rights removed?
That is a much better migration strategy than simply removing admin permissions from everybody on Friday afternoon and discovering the consequences on Monday morning.
5. Azure Virtual Desktop Support Has Expanded
Microsoft's current EPM FAQ also confirms support for Azure Virtual Desktop single-session virtual machines, added in January 2026, alongside existing Windows 365 support.
That makes EPM relevant beyond traditional physical Windows laptops and desktops.
The Most Secure Default Is Not “Let Users Elevate Anything”
An important point in Microsoft's current guidance is the recommended default elevation response.
Microsoft recommends using either:
Deny all requests
or
Require support approval
for files that do not already match an elevation rule.
Why?
Because setting the default to simple user confirmation can effectively allow users to request elevation for arbitrary applications.
Instead, known legitimate software should normally be managed through defined rules, with unfamiliar requests blocked or sent to IT for review.
Microsoft also recommends including file-path restrictions in elevation rules, particularly when creating automatic or wildcard-based rules. Using secure locations helps prevent a legitimate file from being replaced or manipulated before elevation.
This is the difference between controlled privilege management and simply putting a nicer button in front of administrator access.
A Practical EPM Example
Imagine a member of your accounts team uses specialist financial software.
Every few months, the software needs an update requiring administrator permissions.
Traditionally, you might leave the employee as a local administrator because:
“They need it for that program.”
But that means the account has elevated control every day, even though it may only genuinely need it four times a year.
With EPM, the employee can remain a standard user.
The trusted updater can either:
Automatically elevate through a tightly defined rule.
Require user confirmation.
Or require IT approval.
Everything else remains restricted.
That is the principle of just enough privilege, just when it is needed.
EPM Does Not Replace Application Control
It is also important to understand what Endpoint Privilege Management is not.
EPM controls whether a task receives elevated permissions.
It does not by itself decide every application the organisation should or should not be allowed to run.
Microsoft describes EPM and Windows application-control technologies as complementary: EPM manages elevation, while application control determines which software is permitted to run more broadly.
Businesses should therefore see EPM as part of a wider endpoint-security strategy alongside controls such as:
Endpoint Detection and Response.
Microsoft Defender.
Application control.
Patch management.
Vulnerability management.
Microsoft Intune.
Conditional Access.
Device compliance.
Least privilege.
Will EPM Annoy Employees?
Badly configured EPM certainly can.
If an employee has to submit an IT ticket every 20 minutes to perform a routine part of their job, the policy is wrong.
The objective is not:
“Make everything difficult because security.”
The objective is:
“Remove unnecessary permanent privilege while preserving legitimate productivity.”
Microsoft recommends a phased deployment approach that begins with visibility and reporting, identifies user personas and elevation requirements, builds rules, moves appropriate users to standard-user operation and then continually refines policy.
That is the approach businesses should take.
A Sensible EPM Rollout in 2026
Start by identifying who currently has local administrator access.
Then find out why.
Enable appropriate reporting.
Observe which applications actually require elevation.
Group employees with similar requirements.
Create tightly scoped elevation rules.
Use support approval for exceptions.
Move appropriate employees to standard-user accounts.
Monitor the results.
Refine the rules.
The process should progressively remove standing privileges rather than suddenly removing people's ability to work.
Is Endpoint Privilege Management Worth Using?
For organisations managing Windows endpoints through Microsoft Intune, particularly those already using Microsoft 365 E5, EPM is increasingly compelling.
Permanent local administrator access is a significant amount of privilege to grant simply because somebody occasionally needs to install or update an application.
EPM offers a more controlled alternative.
It will not eliminate cyber risk.
It will not replace EDR.
It will not prevent every malicious application.
But it can remove one of the most common and unnecessary sources of excessive privilege from business endpoints.
And with EPM now included in Microsoft 365 E5 from 1 July 2026, many businesses may discover that they already license the capability but simply have not deployed it.
Endpoint Privilege Management With Hamilton Group
Hamilton Group can help businesses review local administrator access and implement Microsoft Intune Endpoint Privilege Management in a way that improves security without unnecessarily frustrating employees.
We can help with:
Microsoft Intune deployment and configuration
Endpoint Privilege Management
Microsoft 365 E5 licence reviews
Local administrator audits
EPM elevation rules
Support-approved workflows
Microsoft Defender and EDR
Conditional Access
Device security and compliance
Ongoing monitoring and managed IT support
For organisations already using Microsoft 365 E5, we can also review whether the July 2026 licensing changes mean capabilities such as EPM are already available within the licences you are paying for.
The goal is not to prevent employees from doing their jobs.
It is to stop them needing unrestricted administrator privileges just to do them.
And when your team needs IT support, our aim is to make first contact within 15 minutes.
Call Hamilton Group on 0330 043 0069 or visit hgmssp.com to speak with one of our Microsoft 365 and cyber-security experts.