Windows Endpoint Privilege Management is configured and assigned

Overview

If Endpoint Privilege Management (EPM) is not configured and assigned in Intune, standard users who need to perform tasks requiring elevated privileges are forced to operate with full local administrator rights. This creates a broad attack surface: a threat actor who compromises any such account immediately inherits persistent local administrator access across every device where that user is elevated. From there, the attacker can dump credentials from the SAM and LSASS, install persistent backdoors, disable security controls such as Microsoft Defender, and move laterally to other systems using harvested credentials.

EPM disrupts this kill chain by enabling users to run as standard users by default while allowing policy-controlled, just-in-time elevation of specific approved files. This reduces the window of exposure, limits privilege escalation paths, and enforces least privilege across the managed Windows device fleet. EPM also provides audit logging of every elevation action, giving security teams visibility into elevation patterns that may indicate compromise.

Both policy types are required: an elevation settings policy enables EPM on the device and sets default elevation behavior, and an elevation rules policy defines granular controls over which files can be elevated. Without either, the environment remains reliant on broad local administrator rights.

Remediation

Configure and assign Windows Endpoint Privilege Management policies in Intune:

• Configure EPM elevation settings policy
• Configure EPM elevation rules policy

For more information, see:

• Endpoint Privilege Management overview
• Plan for Endpoint Privilege Management
• Assign device profiles in Intune

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Medium
Pillar	Devices
Category	Devices
Product	Intune
Feature	Endpoint security
Area	Privileged access
ATT&CK	T1078.003 Local Accounts, T1548.002 Bypass User Account Control, T1003.001 LSASS Memory, T1003.002 Security Account Manager
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.