EPM Infrastructure Limited for Now

The current version of the Intune Endpoint Privilege Management (EPM) add-on service supports elevation of individual executable files, MSI-based installers, and PowerShell scripts. In the latter scenarios, the host processing the installer or script is elevated, not the MSI or PS1 file itself. (Note that EPM does not support elevation of WSH scripts or any other arbitrary file types; it supports only the three file types listed above.)

EPM requires that administrators specify the individual file to be elevated, and the digital certificate used to sign that file can also be applied to the rule to ensure that the executable file has not been modified or compromised since it was approved (the digital signature must also match in order to run).

The approach to elevate applications can be assigned in each rule: 

• Automatic, in which no UI is shown to the user and the operation happens transparently
• User acknowledged, in which the user must approve the elevation (most users will likely