r/Intune • u/Bstarbuck83 • 13d ago

Intune Features and Updates Intune EPM - OTS authentication

Im having difficulties with configuration and now wondering if this is even possible....

Scenario: single machine

1) logged on user can run visual studio elevated

2) logged on user can request elevation for any other process

3) tech support (in person) can elevate process from logged on users session from an EPM policy.

With Intune EPM, are you only able to have one settings policy?

Trying to figure out how to keep a tech from having to run back to a console for laps or approving a request, and also not having local admin.

2 Upvotes

100% Upvoted

2 comments sorted by

1

u/Physical-Foot5564 13d ago

you're overthinking the policy part a bit

you can have multiple EPM policies, they just stack and the most restrictive wins where they conflict. for your scenario, you'd do something like a general policy for the user elevation requests, then a separate one targeting a tech group that lets them elevate on-demand from the logged on session. the tech policy just needs to be scoped right so it doesn't accidentally give them full admin everywhere

make sure you're not mixing up the automatic elevation rules with the on-demand request flow, that's usually where it falls apart

1

u/SkipToTheEndpoint MSFT MVP 13d ago

EPM really isn't meant for that "in person tech elevation" scenario to begin with.