Elevate as Current User" in Microsoft Intune Endpoint Privilege Management (EPM)

 

What is "Elevate as Current User"?

"Elevate as Current User" is a new elevation rule in Microsoft Intune's Endpoint Privilege Management (EPM), introduced in October 2025. It allows processes to run with elevated privileges (like admin rights) under the logged-in user's own account, rather than an isolated virtual account. This improves compatibility for apps that need access to user-specific settings, profiles, or variables, while maintaining security. It's ideal for IT admins reducing unnecessary admin rights in organizations, ensuring better auditing and fewer compatibility issues.

Step-by-Step Guide to Configure and Use "Elevate as Current User"

This guide covers prerequisites, configuration options (automatic and manual), testing, and best practices. Ensure your Intune environment is updated to service release 2510 or later.

Prerequisites

Before setting up the rule:

1. Intune Suite Access: You need the Intune Suite add-on for EPM features.
2. Enable EPM on Devices: Assign a "Windows elevation settings policy" to target devices to activate EPM globally.
3. Gather File Details: Identify the file or app needing elevation (e.g., filename like setup.exe, path, version, product name). Use PowerShell to get the file hash: Get-FileHash -Path "C:\Path\To\File.exe" -Algorithm SHA256.
4. Certificates (Recommended): For secure validation, prepare a .cer file from the app's certificate or use a reusable settings group.
5. Install EpmTools: Download and install the EpmTools PowerShell module to extract file attributes and certificates easily.

Option 1: Automatic Configuration (Recommended for Quick Setup)

Use EPM reports or support requests to auto-generate the rule:

1. Log in to the Microsoft Intune admin center.
2. Navigate to Endpoint security > Endpoint Privilege Management.
   
   
   
   
   
3. Select a source:
   • From Reports > Elevation report: Locate the file in the "File" column and click it to open details.
   • From Elevation request: Select the relevant file.
4. In the details panel, review file info and click Create a rule with these file details.
5. Configure the rule:
   • Policy Option: Choose "Create a new policy" or "Add to existing policy".
   • Set Elevation type to Elevate as current user.
   • Define child process behavior (e.g., "Require rule to elevate" for security).
   • Optionally, check "Require the same file path" to lock the path.
   • Click OK.
6. If creating a new policy, name it and assign it to user or device groups under Assignments.
7. Review and deploy the policy.

Option 2: Manual Configuration

For custom setups:

1. Log in to the Microsoft Intune admin center.
2. Go to Endpoint security > Endpoint Privilege Management > Policies > Create Policy.
3. Select:
   • Platform: Windows.
   • Profile: Windows elevation rules policy.
   • Click Create.
4. Basics Tab: Enter a name (e.g., "Current User Elevation for AppX") and description.
5. Configuration Settings Tab:
   • Click Edit instance on the default rule.
   • Rule Name: e.g., "AppX Elevation Rule".
   • Elevation Type: Select Elevate as current user.
   • File Name: Enter the filename (supports wildcards like * or ?).
   • File Path: Specify the path (e.g., C:\Program Files\) for added security (optional but recommended).
   • Signature Source: Choose certificate validation—upload a .cer file or select a reusable group.
     
     
     
   • File Hash: Add SHA256 hash if no certificate is used.
   • Child Process Behavior: Choose how to handle spawned processes (e.g., "Allow" or "Require rule").
   • File Arguments: Add allowed command-line parameters if needed (e.g., /install).
   • Click Save. Add more rules as required.
6. Scope Tags Tab: Apply tags if your organization uses them.
7. Assignments Tab: Assign to specific user or device groups.
8. Review + Create: Verify settings and create the policy.

How It Works in Practice

• When a user runs the targeted file, an EPM prompt appears.
• The user enters their Windows credentials (supports MFA for added security).
• The process elevates under their own user context, preserving profiles, environment variables, and settings.
• No "business justification" is required, unlike some other rule types.
  
  
  

Testing and Validation

1. Assign the policy to a test group of devices/users.
2. On a test device, attempt to run the file as a standard user.
3. Verify the prompt appears and elevation succeeds under your user account (check Task Manager for user context).
4. Monitor reports: Go to Endpoint Privilege Management > Reports > Elevation report to review events and logs.
5. Check for consistency in audit logs—actions should log under the original user, not a virtual one.
   
   
   

Best Practices and Considerations

• Security Trade-Offs: This rule offers less isolation than virtual accounts, so use it only for apps that truly need user context. Prefer virtual accounts when possible.
• Limit Scope: Apply to trusted files/paths only. Use certificates for validation to prevent tampering.
• Testing: Start with a small pilot group to avoid disruptions.
• Troubleshooting: If issues arise, review device logs or use EPM reports. Common fixes include verifying file hashes or certificates.
• Limitations: Supports Windows only; child processes may need separate rules.