{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-344-do-not-mistake-epm-s-default-response-for-a-universal-application-block/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-344-do-not-mistake-epm-s-default-response-for-a-universal-application-block/", "slug": "dse-20260909-344-do-not-mistake-epm-s-default-response-for-a-universal-application-block", "url": "https://update.dsesecurity.com/updates/dse-20260909-344-do-not-mistake-epm-s-default-response-for-a-universal-application-block/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-344-do-not-mistake-epm-s-default-response-for-a-universal-application-block.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-344-do-not-mistake-epm-s-default-response-for-a-universal-application-block/" }, "title": "Do not mistake EPM's default response for a universal application block", "summary": "Which elevation attempts does EPM's default response actually govern?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:26:12+00:00", "modified_at": "2026-09-10T01:40:03+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 1, "word_count": 220, "potentially_affected": "Review the fallback configuration on EPM-enabled Windows devices. Distinguish matching rules, the EPM context-menu path, and users' existing administrator rights before describing the result as enforcement.", "dse_recommendation": "Write the intended unmatched-file behavior explicitly and verify the route used to request elevation.", "primary_source": { "name": "Managing Elevation Settings for Endpoint Privilege Management - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/epm/manage-elevation-settings", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

An EPM default elevation response applies only when no file rule matches and the user requests elevation through Run with elevated access. Leaving the response unconfigured falls back to denying those requests. Requiring user confirmation permits unmatched files to elevate by default. Conversely, Deny all requests does not stop a user who already has administrative permissions from using Windows Run as administrator for unmanaged files. Microsoft Learn.

\n

Applicability

\n

Review the fallback configuration on EPM-enabled Windows devices. Distinguish matching rules, the EPM context-menu path, and users’ existing administrator rights before describing the result as enforcement.

\n

DSE recommendation

\n

Write the intended unmatched-file behavior explicitly and verify the route used to request elevation. Prefer the source’s restrictive fallback choices unless an approved requirement justifies something else. Do not interpret a confirmation click as proof that a file was preapproved. Review retained local administrator access separately, and explain the difference between the two elevation entry points in helpdesk guidance.

\n

Verification

\n

Use a harmless unmatched file and test the EPM request with an intended standard user. Separately inspect behavior for an authorized test administrator using the Windows entry point. Record which path was exercised and why its outcome is expected. Investigate a matched rule before attributing its result to the default response.

\n

Official references

\n

Microsoft Learn: Managing Elevation Settings for Endpoint Privilege Management.

", "content_text": "Source facts\nAn EPM default elevation response applies only when no file rule matches and the user requests elevation through Run with elevated access. Leaving the response unconfigured falls back to denying those requests. Requiring user confirmation permits unmatched files to elevate by default. Conversely, Deny all requests does not stop a user who already has administrative permissions from using Windows Run as administrator for unmanaged files. Microsoft Learn.\nApplicability\nReview the fallback configuration on EPM-enabled Windows devices. Distinguish matching rules, the EPM context-menu path, and users’ existing administrator rights before describing the result as enforcement.\nDSE recommendation\nWrite the intended unmatched-file behavior explicitly and verify the route used to request elevation. Prefer the source’s restrictive fallback choices unless an approved requirement justifies something else. Do not interpret a confirmation click as proof that a file was preapproved. Review retained local administrator access separately, and explain the difference between the two elevation entry points in helpdesk guidance.\nVerification\nUse a harmless unmatched file and test the EPM request with an intended standard user. Separately inspect behavior for an authorized test administrator using the Windows entry point. Record which path was exercised and why its outcome is expected. Investigate a matched rule before attributing its result to the default response.\nOfficial references\nMicrosoft Learn: Managing Elevation Settings for Endpoint Privilege Management.", "content_markdown": "## Source facts\n\nAn EPM default elevation response applies only when no file rule matches and the user requests elevation through Run with elevated access. Leaving the response unconfigured falls back to denying those requests. Requiring user confirmation permits unmatched files to elevate by default. Conversely, Deny all requests does not stop a user who already has administrative permissions from using Windows Run as administrator for unmanaged files. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/epm/manage-elevation-settings).\n\n## Applicability\n\nReview the fallback configuration on EPM-enabled Windows devices. Distinguish matching rules, the EPM context-menu path, and users’ existing administrator rights before describing the result as enforcement.\n\n## DSE recommendation\n\nWrite the intended unmatched-file behavior explicitly and verify the route used to request elevation. Prefer the source’s restrictive fallback choices unless an approved requirement justifies something else. Do not interpret a confirmation click as proof that a file was preapproved. Review retained local administrator access separately, and explain the difference between the two elevation entry points in helpdesk guidance.\n\n## Verification\n\nUse a harmless unmatched file and test the EPM request with an intended standard user. Separately inspect behavior for an authorized test administrator using the Windows entry point. Record which path was exercised and why its outcome is expected. Investigate a matched rule before attributing its result to the default response.\n\n## Official references\n\n[Microsoft Learn: Managing Elevation Settings for Endpoint Privilege Management](https://learn.microsoft.com/en-us/intune/epm/manage-elevation-settings)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-344-do-not-mistake-epm-s-default-response-for-a-universal-application-block/", "url": "https://update.dsesecurity.com/updates/dse-20260909-344-do-not-mistake-epm-s-default-response-for-a-universal-application-block/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-344-do-not-mistake-epm-s-default-response-for-a-universal-application-block/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Do not mistake EPM's default response for a universal application block", "item": "https://update.dsesecurity.com/updates/dse-20260909-344-do-not-mistake-epm-s-default-response-for-a-universal-application-block/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-344-do-not-mistake-epm-s-default-response-for-a-universal-application-block/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-344-do-not-mistake-epm-s-default-response-for-a-universal-application-block/", "url": "https://update.dsesecurity.com/updates/dse-20260909-344-do-not-mistake-epm-s-default-response-for-a-universal-application-block/", "headline": "Do not mistake EPM's default response for a universal application block", "description": "Which elevation attempts does EPM's default response actually govern?", "abstract": "Which elevation attempts does EPM's default response actually govern?", "articleBody": "Source facts\nAn EPM default elevation response applies only when no file rule matches and the user requests elevation through Run with elevated access. Leaving the response unconfigured falls back to denying those requests. Requiring user confirmation permits unmatched files to elevate by default. Conversely, Deny all requests does not stop a user who already has administrative permissions from using Windows Run as administrator for unmanaged files. Microsoft Learn.\nApplicability\nReview the fallback configuration on EPM-enabled Windows devices. Distinguish matching rules, the EPM context-menu path, and users’ existing administrator rights before describing the result as enforcement.\nDSE recommendation\nWrite the intended unmatched-file behavior explicitly and verify the route used to request elevation. Prefer the source’s restrictive fallback choices unless an approved requirement justifies something else. Do not interpret a confirmation click as proof that a file was preapproved. Review retained local administrator access separately, and explain the difference between the two elevation entry points in helpdesk guidance.\nVerification\nUse a harmless unmatched file and test the EPM request with an intended standard user. Separately inspect behavior for an authorized test administrator using the Windows entry point. Record which path was exercised and why its outcome is expected. Investigate a matched rule before attributing its result to the default response.\nOfficial references\nMicrosoft Learn: Managing Elevation Settings for Endpoint Privilege Management.", "datePublished": "2026-09-10T00:26:12+00:00", "dateModified": "2026-09-10T01:40:03+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-344-do-not-mistake-epm-s-default-response-for-a-universal-application-block/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-344-do-not-mistake-epm-s-default-response-for-a-universal-application-block/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Do not mistake EPM's default response for a universal application block" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 220, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Managing Elevation Settings for Endpoint Privilege Management - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/epm/manage-elevation-settings" } } ] } }