# What endpoint privilege management is, and what it costs you > Removing local admin rights limits what one compromised laptop can do. The cost is a rule set and an approval queue someone has to staff. Source: https://fmcybersecurity.com/en/insights/identity/what-endpoint-privilege-management-is/ Locale: English Other locale: https://fmcybersecurity.com/insights/identity/hva-er-rettighetsstyring-pa-endepunkter/ ## Metadata - Date: 2026-07-27 - Author: robin-kvernevik - Topic: identity - Format: article Local administrator rights are the cheapest thing you ever hand an employee and the most expensive thing to take back. On a laptop where the signed-in user is a local admin, one bad click installs software, switches off tooling, and reaches the next machine with the same rights. I lead FM CyberSecurity's privileged access work, and large privilege deployments are what I have spent my career on. In the Norwegian organizations I sit with, the story repeats. Admin rights went out years ago to stop helpdesk tickets, nobody owns the decision today, and nobody can say how many admin accounts exist until we count them. Endpoint privilege management, EPM in most product catalogues, is the category built for that problem. Users sign in as standard users. An agent on the machine grants elevation to named applications under named rules, and writes a log line every time it does. ## What removing local admin rights buys you Privilege is what turns a bad file into a bad quarter. In [BeyondTrust's 2026 Microsoft Vulnerabilities Report](https://www.beyondtrust.com/resources/whitepapers/microsoft-vulnerability-report), published May 2026, elevation of privilege made up 40 percent of the 1,273 Microsoft vulnerabilities disclosed during 2025, and critical vulnerabilities doubled from 78 to 157. Norwegian guidance has said the same for years, in plainer words. [NSM's grunnprinsipper for IKT-sikkerhet](https://nsm.no/regelverk-og-hjelp/rad-og-anbefalinger/grunnprinsipper-for-ikt-sikkerhet/beskytte-og-opprettholde/ha-kontroll-pa-identiteter-og-tilganger/) tell you to take admin rights off ordinary office users, because an attacker who lands inside a session inherits whatever that session holds (tiltak 2.6.4). [CIS Controls v8.1](https://www.cisecurity.org/controls/account-management) says it as Safeguard 5.4: admin rights live on dedicated admin accounts, and email and browsing happen from the account that has none. Neither source asks you to buy anything. Both ask you to make a decision you can evidence, which is why auditors ask for it too. ## How elevation policies work, and what they cost An EPM agent decides, per application, whether elevation happens automatically, after the user confirms, after support approves, or not at all. [Microsoft's Intune documentation](https://learn.microsoft.com/en-us/intune/intune-service/protect/epm-overview) describes those four options plus a deny rule, and elevates through an isolated virtual account rather than adding anyone to the local administrators group. Every serious product in the category works on that same shape. The cost lands on the helpdesk. Any application your rules do not cover becomes a ticket, and the weeks right after you flip the switch produce the heaviest ticket load you will see. Budget for those weeks instead of discovering them. Check what you already own before you price anything new. From 1 July 2026, Endpoint Privilege Management is part of Microsoft 365 E5 rather than a separate add-on, per the [Microsoft Intune Blog](https://techcommunity.microsoft.com/blog/microsoftintuneblog/advanced-microsoft-intune-capabilities-now-available-in-microsoft-365-e3-and-e5/4529335). ## Where this sits next to EDR and server PAM EPM controls what is allowed to run elevated. [EDR](/en/insights/endpoint/edr-and-antivirus-what-the-difference-is/) detects and responds after something runs. EDR tells you what an attacker did; EPM shrinks what the attacker could do at all, so neither replaces the other. Privileged access management for servers and admin accounts is a third thing again: vaulting, session isolation and password rotation for the accounts your administrators use on domain controllers and infrastructure. EPM covers the workstation fleet. [Our identity practice](/en/services/identity/) runs the two as one program with two rollouts, because the same person usually owns both risks. ## What a realistic rollout looks like, and how it fails Run in audit mode first, then write rules from data. EPM agents report on the elevations happening today with no policy in place, which hands you a ranked list of what your users really elevate. Build rules for the top of that list, take admin rights off a pilot group, and expand from there. The failure mode is a blanket policy shipped without that data. Everyone loses admin rights on the same Monday, every unlisted application turns into an approval request, and the queue lands on a support team with no named owner and no response target. Then admin rights come back to unblock the business, and the program is finished. ## The decision in front of you The question is not which product. It is whether you will staff elevation approvals and name the person who owns the rule set. Answer yes and the tooling choice is small. Answer no and no product will hold. FM CyberSecurity delivers this practice on [Idira (CyberArk) Endpoint Privilege Manager](/en/products/cyberark/endpoint-privilege-manager/), which we run end to end. If the name is new to you, [CyberArk is now Idira](/en/insights/identity/cyberark-is-now-idira/) covers the rename, and [what the Idira EPM agent control panel is](/en/insights/identity/what-the-idira-epm-agent-control-panel-is/) covers what the agent looks like on the machine. See our certifications and what we run on the [Idira partner page](/en/partners/cyberark/). Or book a 30-minute conversation with me about your admin-rights position before you shortlist a tool. ## FAQ ### Do we still need EDR if we remove local admin rights? Yes. Plenty of attacks work fine inside a standard user session: stealing browser tokens, reading files the user can read, phishing further inside the company. Removing admin rights limits how far that goes and how permanent it becomes. Detection still has to be there. ### What do we do about developers? Scope them, do not exempt them. Developers need to install packages and debug, and they usually need a small set of tools elevated rather than blanket admin. Give that group its own rules, and watch what they elevate for the first month before you tighten anything. ### Is endpoint privilege management the same as PAM? No. PAM protects the privileged accounts your administrators use on servers and infrastructure, with vaults, session isolation and rotation. EPM protects the workstation by making the everyday user a standard user. Most organizations need both, and it is usually cheaper to run them as one program. ### Can we do this with what Microsoft already gives us? Often, yes, and you should check before buying. Where a mixed fleet, servers, or a bigger privileged-account problem is in play, a dedicated platform earns its price. That comparison is worth an hour with someone who has done both. *Drafted with AI assistance, reviewed and edited by Robin Kvernevik and the FM CyberSecurity editorial team.* --- For the full documentation index, see https://fmcybersecurity.com/llms.txt For the complete corpus as a single document, see https://fmcybersecurity.com/llms-full.txt