Endpoint Privilege Management Elevations (30 days)
The question it answers: Which apps did users run elevated through Endpoint Privilege Management in the last 30 days, and how often?
Endpoint Privilege Management lets standard users run approved apps elevated. The elevation log shows what people actually need admin rights for: frequently confirmed elevations are candidates for automatic rules (fewer prompts and tickets), and unmanaged elevations show where rules are missing. It also shows whether the add-on is used at all.
At a glance
Section titled “At a glance”| Where in the app | Intune › Device Operations & Hardening › EPM Elevations |
| Workload | Intune |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). |
| Licence | Intune Suite or the Endpoint Privilege Management add-on. |
| Report id (API and MCP) | intune.operations.epm-elevations |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Elevation types | Category | Text |
| File | Subject | Link |
| Check | Setting | Text |
| Publisher / product | Value | Text |
| Finding | Finding | Text |
| Users / devices / path | Detail | Text |
| Last elevation | When | Date |
| Elevations | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: Intune Suite or the Endpoint Privilege Management add-on.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
DeviceManagementConfiguration.Read.All | Microsoft Graph | Read Microsoft Intune device configuration and policies | + Intune RBAC ‘EPM - View Reports’ |
Data sources it reads
GET /beta/deviceManagement/privilegeManagementElevations
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/intune.operations.epm-elevations?size=100An AI assistant reads it with the MCP tool get_report and the id intune.operations.epm-elevations. The client needs the Read grant for Intune. See Using the API.