{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-154-evaluate-the-profile-dependency-before-choosing-epm-current-user-elevation/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-154-evaluate-the-profile-dependency-before-choosing-epm-current-user-elevation/", "slug": "dse-20260909-154-evaluate-the-profile-dependency-before-choosing-epm-current-user-elevation", "url": "https://update.dsesecurity.com/updates/dse-20260909-154-evaluate-the-profile-dependency-before-choosing-epm-current-user-elevation/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-154-evaluate-the-profile-dependency-before-choosing-epm-current-user-elevation.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-154-evaluate-the-profile-dependency-before-choosing-epm-current-user-elevation/" }, "title": "Evaluate the profile dependency before choosing EPM current-user elevation", "summary": "When does an application's user-profile dependency justify EPM Elevate as current user?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:29:22+00:00", "modified_at": "2026-09-10T00:55:35+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 221, "potentially_affected": "Apply this decision to an application already being evaluated for EPM elevation. Identify which task depends on the active profile rather than assuming every installer needs the current-user mode.", "dse_recommendation": "Require a reproducible profile-related failure before granting the less-isolated elevation mode.", "primary_source": { "name": "Plan and Prepare for Endpoint Privilege Management Deployment - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/epm/deployment-planning", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Endpoint Privilege Management normally elevates through a virtual account, separating the elevated process from the user’s profile. Elevate as current user instead keeps the signed-in identity and its profile paths, environment variables, and personalized settings; Windows authentication is required. Microsoft describes this as a compatibility choice that increases exposure to user data, and advises using it only when virtual-account elevation causes application failures. Microsoft Learn.

\n

Applicability

\n

Apply this decision to an application already being evaluated for EPM elevation. Identify which task depends on the active profile rather than assuming every installer needs the current-user mode.

\n

DSE recommendation

\n

Require a reproducible profile-related failure before granting the less-isolated elevation mode. Ask the application owner to document the failed operation, relevant profile dependency, and approved executable location. Prefer a narrowly scoped exception over changing an entire software category. Have the security owner explicitly review the additional user-data exposure and the intended credential prompt.

\n

Verification

\n

Compare the same approved task under virtual-account and current-user elevation in a representative test profile. Inspect which identity and profile paths the process actually uses, then verify that the task succeeds without unrelated privileged activity. Retain the comparison and exception owner. Revisit the exception after an application update instead of assuming the compatibility need is permanent.

\n

Official references

\n

Microsoft Learn: Plan and Prepare for Endpoint Privilege Management Deployment.

", "content_text": "Source facts\nEndpoint Privilege Management normally elevates through a virtual account, separating the elevated process from the user’s profile. Elevate as current user instead keeps the signed-in identity and its profile paths, environment variables, and personalized settings; Windows authentication is required. Microsoft describes this as a compatibility choice that increases exposure to user data, and advises using it only when virtual-account elevation causes application failures. Microsoft Learn.\nApplicability\nApply this decision to an application already being evaluated for EPM elevation. Identify which task depends on the active profile rather than assuming every installer needs the current-user mode.\nDSE recommendation\nRequire a reproducible profile-related failure before granting the less-isolated elevation mode. Ask the application owner to document the failed operation, relevant profile dependency, and approved executable location. Prefer a narrowly scoped exception over changing an entire software category. Have the security owner explicitly review the additional user-data exposure and the intended credential prompt.\nVerification\nCompare the same approved task under virtual-account and current-user elevation in a representative test profile. Inspect which identity and profile paths the process actually uses, then verify that the task succeeds without unrelated privileged activity. Retain the comparison and exception owner. Revisit the exception after an application update instead of assuming the compatibility need is permanent.\nOfficial references\nMicrosoft Learn: Plan and Prepare for Endpoint Privilege Management Deployment.", "content_markdown": "## Source facts\n\nEndpoint Privilege Management normally elevates through a virtual account, separating the elevated process from the user’s profile. Elevate as current user instead keeps the signed-in identity and its profile paths, environment variables, and personalized settings; Windows authentication is required. Microsoft describes this as a compatibility choice that increases exposure to user data, and advises using it only when virtual-account elevation causes application failures. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/epm/deployment-planning).\n\n## Applicability\n\nApply this decision to an application already being evaluated for EPM elevation. Identify which task depends on the active profile rather than assuming every installer needs the current-user mode.\n\n## DSE recommendation\n\nRequire a reproducible profile-related failure before granting the less-isolated elevation mode. Ask the application owner to document the failed operation, relevant profile dependency, and approved executable location. Prefer a narrowly scoped exception over changing an entire software category. Have the security owner explicitly review the additional user-data exposure and the intended credential prompt.\n\n## Verification\n\nCompare the same approved task under virtual-account and current-user elevation in a representative test profile. Inspect which identity and profile paths the process actually uses, then verify that the task succeeds without unrelated privileged activity. Retain the comparison and exception owner. Revisit the exception after an application update instead of assuming the compatibility need is permanent.\n\n## Official references\n\n[Microsoft Learn: Plan and Prepare for Endpoint Privilege Management Deployment](https://learn.microsoft.com/en-us/intune/epm/deployment-planning)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-154-evaluate-the-profile-dependency-before-choosing-epm-current-user-elevation/", "url": "https://update.dsesecurity.com/updates/dse-20260909-154-evaluate-the-profile-dependency-before-choosing-epm-current-user-elevation/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-154-evaluate-the-profile-dependency-before-choosing-epm-current-user-elevation/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Evaluate the profile dependency before choosing EPM current-user elevation", "item": "https://update.dsesecurity.com/updates/dse-20260909-154-evaluate-the-profile-dependency-before-choosing-epm-current-user-elevation/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-154-evaluate-the-profile-dependency-before-choosing-epm-current-user-elevation/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-154-evaluate-the-profile-dependency-before-choosing-epm-current-user-elevation/", "url": "https://update.dsesecurity.com/updates/dse-20260909-154-evaluate-the-profile-dependency-before-choosing-epm-current-user-elevation/", "headline": "Evaluate the profile dependency before choosing EPM current-user elevation", "description": "When does an application's user-profile dependency justify EPM Elevate as current user?", "abstract": "When does an application's user-profile dependency justify EPM Elevate as current user?", "articleBody": "Source facts\nEndpoint Privilege Management normally elevates through a virtual account, separating the elevated process from the user’s profile. Elevate as current user instead keeps the signed-in identity and its profile paths, environment variables, and personalized settings; Windows authentication is required. Microsoft describes this as a compatibility choice that increases exposure to user data, and advises using it only when virtual-account elevation causes application failures. Microsoft Learn.\nApplicability\nApply this decision to an application already being evaluated for EPM elevation. Identify which task depends on the active profile rather than assuming every installer needs the current-user mode.\nDSE recommendation\nRequire a reproducible profile-related failure before granting the less-isolated elevation mode. Ask the application owner to document the failed operation, relevant profile dependency, and approved executable location. Prefer a narrowly scoped exception over changing an entire software category. Have the security owner explicitly review the additional user-data exposure and the intended credential prompt.\nVerification\nCompare the same approved task under virtual-account and current-user elevation in a representative test profile. Inspect which identity and profile paths the process actually uses, then verify that the task succeeds without unrelated privileged activity. Retain the comparison and exception owner. Revisit the exception after an application update instead of assuming the compatibility need is permanent.\nOfficial references\nMicrosoft Learn: Plan and Prepare for Endpoint Privilege Management Deployment.", "datePublished": "2026-09-10T00:29:22+00:00", "dateModified": "2026-09-10T00:55:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-154-evaluate-the-profile-dependency-before-choosing-epm-current-user-elevation/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-154-evaluate-the-profile-dependency-before-choosing-epm-current-user-elevation/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Evaluate the profile dependency before choosing EPM current-user elevation" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 221, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Plan and Prepare for Endpoint Privilege Management Deployment - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/epm/deployment-planning" } } ] } }