Intune Endpoint Privilege Management: Licensing and a 50-User Rollout

EPM is an Intune capability for Windows that lets a standard user run a specific program with administrator rights without holding those rights all the time. You define which files may elevate and how; the Intune agent on the device performs the elevation. Microsoft documents three paths (Microsoft Learn, Learn about using Endpoint Privilege Management with Microsoft Intune, checked October 2026):

• Automatic. The matched application elevates with no prompt. A file hash is required, so it fits a fixed binary, not an installer that changes with every release.
• User confirmed. The user right-clicks the file and chooses Run with elevated access. You can require Windows authentication, a typed business justification, or both.
• Support approved. The user submits a request from the device; an administrator approves it in the Intune admin center; the user is notified and retries.

Two more behaviors matter. Deny blocks a file from ever elevating and always wins over any other matching rule. Elevate as current user runs the process under the user's own account instead of EPM's virtual account; Microsoft says to use it only when the virtual account breaks the application. When several non-hash rules match the same file, Microsoft applies them in this order: user confirmed, elevate as current user, support approved, automatic.

EPM uses two policy types. An elevation settings policy turns EPM on for a group of devices and sets the default response for any file that matches no rule. An elevation rules policy holds the rules. Every managed elevation is reported, and the reporting scope can include elevations users perform outside your rules, which is what makes discovery possible before you remove admin rights.

EPM is narrower than the name suggests, and buying it for the wrong problem is the common mistake.

• It is Windows only. Microsoft's supported operating systems are Windows 10 and Windows 11 builds; there is no macOS agent. Macs keep their own admin model, covered in our Intune for Macs guide.
• It does not manage cloud administrators. Privileged roles in Entra ID and Azure belong to Privileged Identity Management, which needs Entra ID P2; see Entra ID P1 vs P2.
• It is not application control. EPM decides what may run elevated; it does not stop a standard user from running unapproved software at standard rights.
• It does not remove the admin rights for you. You still take users out of the local Administrators group, with an Intune account protection policy, after the rules are in place.
• Reports are not real time. Microsoft states that report data is processed once every 24 hours, so discovery takes weeks, not an afternoon.

Keep one break-glass local administrator account on each device, managed by Windows LAPS from Intune, for the day the agent or the network is down.

EPM is licensed per user in addition to an Intune Plan 1 or Plan 2 entitlement (Microsoft Learn, Plan and prepare for Endpoint Privilege Management deployment, checked October 2026). Prices are per user per month on an annual term, Commercial segment (Microsoft list price, October 2026 price list); the list carries annual figures, so EPM is $36.00 per user per year, and $36.00 ÷ 12 = $3.00.

Most tenants already hold the prerequisite: Intune Plan 1 is inside Microsoft 365 Business Premium, E3, E5, F1 and F3, as our Intune licensing guide lays out. Microsoft's Intune pricing page states that from July 2026 Microsoft 365 E5 includes EPM, Cloud PKI and Enterprise App Management, while E3 receives Remote Help, Advanced Analytics and the Intune Plan 2 capabilities (Microsoft, Microsoft Intune plans and pricing, checked October 2026). So an E5 tenant pays nothing more; an E3 or Business Premium tenant buys the $3.00 add-on or the Suite.

The decision rule is arithmetic. One capability: buy the add-on. EPM plus Remote Help is $3.00 + $3.50 = $6.50, still under the Suite. Add Advanced Analytics at $5.00 and the three come to $11.50, so the Suite at $10.00 costs less and brings Cloud PKI, Enterprise App Management and Plan 2 with it.

Microsoft's deployment planning page lists what a device needs (checked October 2026):

1. Windows version. Windows 11 21H2 through 24H2, or Windows 10 21H2 and 22H2, with the updates Microsoft names; 64-bit only, including Arm64. Microsoft lists versions and join state rather than editions; in practice the join requirement means the Pro, Enterprise and Education editions that can join Entra ID.
2. Join state. Microsoft Entra joined or Microsoft Entra hybrid joined.
3. Management. Enrolled in Intune, or co-managed with Configuration Manager.
4. Policy. An elevation settings policy that enables EPM must reach the device; rules alone do nothing.
5. License. The user holds EPM, the Intune Suite or a qualifying E5 license in addition to Intune Plan 1 or Plan 2.
6. Network. The EPM endpoints must not pass through SSL inspection.

Microsoft's EPM FAQ adds that Windows 365 Cloud PCs are supported (added September 2023) and Azure Virtual Desktop single-session virtual machines are supported (added January 2026). If part of the fleet is still joined only to on-premises Active Directory, the cloud-only migration or hybrid join comes first.

This is the sequence our Intune Endpoint Privilege Management Implementation service follows; it assumes Business Premium or E3 with devices already Entra joined and enrolled.

A sample rule set for a 50-user firm

Two habits keep the set small. Always include the file path, which Microsoft recommends for every rule, and leave the default response at Require support approval or Deny rather than Require user confirmation, which Microsoft also recommends, so that an unlisted program never elevates on a user's say-so alone.

After go-live, Microsoft's monitoring page gives five views: the Elevation report, the Managed elevations report, and aggregated views by application, publisher and user (Microsoft Learn, Monitor your Endpoint Privilege Management policies, checked October 2026). A weekly twenty minutes covers it: clear the support-approved queue, sort the Elevation report by application for a new installer users keep requesting, and check the by-user view for one person generating most requests. Any file that appears three weeks running gets a rule or a replacement.

Microsoft subscription prices are the customer's own, billed at Microsoft's list price (Microsoft list price, October 2026 price list, annual term):

• EPM add-on for 50 users: 50 × $3.00 = $150.00 per month, $1,800.00 per year.
• Intune Suite for 50 users, if Remote Help and Advanced Analytics are also wanted: 50 × $10.00 = $500.00 per month, $6,000.00 per year.
• Microsoft 365 E5 tenants: $0.00 extra, since EPM is in the E5 packaging from July 2026.

Our Intune Endpoint Privilege Management Implementation service is $2,950.00 per project, quoted in writing before work begins. It covers the discovery period, the elevation settings and rules policies, the pilot, the two rollout waves, the removal of local admin rights, the LAPS check and the handover documents. Ongoing rule maintenance can sit under the Managed Microsoft Intune Service at $5.00 per device per month.

For a tenant that has not finished its Intune baseline, the Microsoft Intune Initial Setup for Windows Device Management comes first; our Group Policy to Intune guide explains why.

What is endpoint privilege management?

Endpoint privilege management is the practice of letting people work as standard users while specific programs run with administrator rights under rules. In Microsoft 365, Intune Endpoint Privilege Management is the feature that does this on Windows, with automatic, user-confirmed and support-approved elevation and a report of every elevation.

Is Endpoint Privilege Management included in Intune?

Not in Intune Plan 1 or Plan 2. EPM is a separate add-on at $3.00 per user per month, or part of the Intune Suite at $10.00 (Microsoft list price, October 2026 price list), and it requires Plan 1 or Plan 2 underneath. Microsoft 365 E5 includes it from July 2026.

How much does Intune Endpoint Privilege Management cost?

$3.00 per user per month on an annual term, from $36.00 per user per year, Commercial segment. The frontline variant is $2.00, the Education prices are $0.60 for faculty and $0.45 for students, and the full Intune Suite is $10.00.

Endpoint Privilege Manager or Endpoint Privilege Management: is it the same thing?

Microsoft's product is Endpoint Privilege Management; "Endpoint Privilege Manager" is the name of some third-party products and a common way people search for the Microsoft feature. If you are on Microsoft 365, the Intune feature in this article is the one to evaluate first because it needs no additional agent.

Does EPM work on Windows Home or on Macs?

No. Microsoft's prerequisites require a device that is Entra joined or hybrid joined and enrolled in Intune, running a supported Windows 10 or Windows 11 build. There is no macOS version.

Can we keep one application that needs admin rights without giving the user admin rights?

Yes. That is the case EPM was built for: a user-confirmed or support-approved rule on that application's executable lets it elevate while the user stays a standard user everywhere else. The rollout takes about seven weeks for 50 users, most of it the discovery period, because report data arrives once every 24 hours.

• Learn about using Endpoint Privilege Management with Microsoft Intune — Microsoft Learn, checked 2026-10-11
• Plan and prepare for Endpoint Privilege Management deployment — Microsoft Learn, checked 2026-10-11
• Creating elevation rules with Endpoint Privilege Management — Microsoft Learn, checked 2026-10-11
• Monitor your Endpoint Privilege Management policies for Microsoft Intune — Microsoft Learn, checked 2026-10-11
• Frequently asked questions for Endpoint Privilege Management — Microsoft Learn, checked 2026-10-11
• Use Endpoint Privilege Management to transition users from administrator to standard user — Microsoft Learn, checked 2026-10-11
• Microsoft Intune plans and pricing — Microsoft, checked 2026-10-11
• Microsoft Intune licensing plans and options — Microsoft Learn, checked 2026-10-11
• Microsoft US Commercial and Education price lists, October 2026: Intune Endpoint Privilege Management, Intune Suite, Intune Plan 1 and the FLW and Education variants