Staff the EPM approval queue before requiring support-approved elevation

Source facts

Intune does not notify administrators when a new EPM elevation request arrives. An approval permits the requesting user to elevate that file on that device for 24 hours from approval; administrators cannot customize or cancel that period early. Denied users are not automatically notified. Reviewing requests requires the EPM elevation-request permissions within the administrator’s configured scope. Microsoft Learn.

Applicability

Use this operating plan for support-approved Endpoint Privilege Management requests. Confirm who can review the relevant device population and who will communicate with the requester.

DSE recommendation

Assign queue coverage and a documented checking interval before making approval a dependency for routine work. Review the requested file, user, device, and business reason together. Approve only when the owner accepts the complete elevation window; do not promise an early withdrawal that the documented workflow cannot provide. Require a decision reason in the team’s procedure and contact denied users directly with the approved explanation.

Verification

Submit an authorized test request and confirm that the assigned reviewer can find it without relying on an alert. Check the approval time and expiration, and verify the intended file’s behavior on the requesting device. Separately rehearse a denial and the helpdesk’s manual response. Retain the decision trail and any communication delay, then adjust staffing before expanding the workflow.

Official references

Microsoft Learn: Use EPM support approvals for file elevation requests with Intune.