Prove standard-user elevation before removing local administrator rights

Source facts

Microsoft recommends auditing first and using the resulting elevation data to identify usage patterns and user personas. Its rule validation step explicitly signs in with standard-user credentials and tests Run with elevated access. The guide notes that reported usage can take 24 hours to arrive and that understanding usage patterns can require several weeks. Microsoft Learn.

Applicability

Use this review when planning an Intune Endpoint Privilege Management transition from local administrators to standard users. Define the actual work roles and required elevated tasks before selecting the pilot population.

DSE recommendation

DSE recommends making demonstrated standard-user workflows the exit criterion for each pilot persona. Include infrequent maintenance tasks in the observation plan and assign an owner to unresolved elevation needs. Review the intended elevation rules with those owners before scheduling administrator-rights removal.

Verification

Use an approved standard-user test account to perform each required workflow through the proposed elevation path. Record what was allowed, what was denied and how support handled an exception. Review the delayed reports alongside direct observations, then obtain the pilot owner’s acceptance before expanding the rights change.

Official references

Microsoft Learn: Use Endpoint Privilege Management to transition users from administrator to standard user. Source reviewed September 17, 2026.