Administrator Protection Is Coming to Windows 11: How Does It Compare to Intune EPM?
After disappearing from earlier preview releases, Administrator Protection is rolling out again through Windows 11 preview updates, with the latest Release Preview build bringing the feature to Windows 11 26H1.
What Happened
Administrator Protection first showed up in Insider builds back in late 2024. Microsoft kept refining it over the following months, but the feature later disappeared from preview builds and wasn’t included in the broader rollout plans at the time.
Google Project Zero subsequently disclosed research identifying multiple ways to bypass Administrator Protection: nine separate bypasses found during its initial research in January 2026, plus additional UI Access-related bypass classes detailed in a follow-up post in February 2026. Microsoft later disabled the feature while addressing an application compatibility issue, though it did not publicly link that change to the Project Zero research.
Microsoft has now started rolling the feature out again through recent preview updates: KB5120998 brought it back to the 24H2 and 25H2 optional preview in August 2026, and the latest Release Preview build (KB5124006, build 28000.3079) brings it to 26H1.
How Administrator Protection Works
Administrator Protection keeps administrator users in a de-privileged state and grants just-in-time elevation only when an administrative action is required even if the account sits in the local Administrators group, it doesn’t walk around with a standing admin token. When an action needs elevated privileges, Windows authenticates the request through Windows Hello and issues a temporary token from a hidden, profile-separated system account. The temporary elevation context is removed once the elevated process exits.
Microsoft’s positioning of the security-boundary aspect has evolved as the feature matured. Earlier communications highlighted the isolation model as a security boundary, while more recent documentation focuses on its hardening benefits instead Microsoft’s current Release Preview documentation explicitly says Administrator Protection isn’t classified as a formal security boundary. The underlying design goal remains the same: to isolate elevated operations from the user’s standard context.
Deployment-wise, it’s still opt-in and disabled by default. You can currently configure it through the Intune Settings Catalog (preview) or Windows Security settings (preview), or through CSP and Group Policy. It’s not supported on Windows Server, Windows 365 Cloud PC, or Azure Virtual Desktop session hosts.
One thing to keep in mind: Administrator Protection isn’t completely transparent for every application. Because elevated processes run in a profile-separated context, some applications may behave differently when they assume the elevated process shares the user’s normal profile or identity Microsoft’s documentation flags roaming profiles, backup admin scenarios, remote logon, and certain application install/update flows as areas to check. Test business-critical applications before broad deployment.
How to Enable Administrator Protection with Intune
You’ll need to turn it on yourself for now:
- In the Intune admin center, create a Settings Catalog policy and look under Local Policies Security Options for the relevant User Account Control settings specifically “Configure type of Admin Approval Mode” and “Behavior of the elevation prompt for administrators running with Administrator protection.”
- Enable the setting and assign the profile to a pilot group first this policy area is still preview and the enforcement behavior can change between builds.
- Reboot the target devices, since the setting only applies after restart.
If you’re not on a build that exposes the Settings Catalog option yet, the CSP and GPO paths work the same way but require manual configuration rather than a built-in policy template.
Administrator Protection vs. EPM
If you’ve already deployed Endpoint Privilege Management in Intune, this probably sounds familiar both features exist to get rid of standing local admin rights. But they solve the problem from different angles, and they’re not interchangeable. Here’s how they stack up:
| Feature | Administrator Protection | Endpoint Privilege Management (EPM) |
|---|---|---|
| Where it lives | Native Windows 11 OS feature | Intune-managed privilege management feature |
| Who it’s for | Administrator users who need occasional administrative access | Standard users who need controlled elevation for specific applications or administrative tasks |
| How elevation works | Just-in-time, per-action, via a hidden system-managed admin account | Through centrally managed elevation rules and policies |
| Authentication | Windows Hello (PIN, biometric) at the moment of elevation | Depends on policy: automatic elevation, user-confirmed elevation, or a support-approved workflow |
| Scope of control | Broad OS-level coverage for supported administrator elevation scenarios | Granular IT decides exactly which apps/files can run elevated |
| Management overhead | Low once enabled mostly a device-wide switch | Higher requires creating and maintaining elevation rules and policies |
| Deployment | Intune Settings Catalog, CSP, GPO | Intune |
| Licensing | Included with supported Windows 11 editions | Requires an eligible Intune/EPM entitlement available standalone, through Intune Suite, or included in some Microsoft 365 plans |
| Best fit | General-purpose hardening across the fleet | Environments that need tight, auditable control over which elevated actions are allowed |
Will Administrator Protection Replace EPM?
Probably not.
Administrator Protection reduces the risk tied to standing administrator privileges, but it doesn’t give you application-level allowlists, approval workflows, reporting, or per-app elevation policies. It’s a device-wide switch, not a control plane. Organizations that need to decide exactly which applications are allowed to run elevated and want an audit trail of who elevated what and when may still need EPM or a similar privilege management solution on top of it.
The Practical Takeaway
They’re not really competing features they answer different questions. EPM answers “which specific apps am I willing to let run elevated?” Administrator Protection answers “how do I stop standing admin tokens from being sitting ducks?”
The two technologies can also be used together: EPM can provide centrally managed application elevation, while Administrator Protection can reduce the exposure associated with standing administrator privileges particularly for less predictable, one-off elevation requests that are difficult to manage through individual EPM rules.
The practical choice depends on the privilege model an organization needs: EPM provides centrally managed, application-level elevation, while Administrator Protection provides OS-level protection for administrator accounts without requiring an additional license. For organizations already using EPM, Administrator Protection is therefore better viewed as a complementary Windows security control rather than a replacement.
Sources
- Microsoft Learn – Administrator protection
- Windows IT Pro Blog – Administrator protection on Windows 11
- Windows Insider – Release Preview Build 28000.3079 (26H1)
- Microsoft Support – KB5120998 (Windows 11 24H2/25H2)
- Google Project Zero – Bypassing Windows Administrator Protection
- Google Project Zero – Bypassing Administrator Protection by Abusing UI Access
- Microsoft Learn – Endpoint Privilege Management overview
