Intune Endpoint Privilege Management: Network Settings Elevation for Standard Users

Why network settings elevation matters for standard-user devices

Many organizations want employees to sign in as standard users rather than local administrators, since standard accounts reduce the risk of malware or accidental changes affecting the whole device. The trade-off is that everyday tasks — like setting a static IP address or changing a DNS server when connecting at a new office or client site — normally trigger a User Account Control (UAC) prompt that a standard user can’t get past.

Microsoft Intune’s Endpoint Privilege Management (EPM) is designed to close that gap. A specific EPM policy type now lets administrators grant standard users the ability to change a defined set of network adapter settings, without handing out broad administrator rights or deploying a separate helper application. This article explains what’s supported, how elevation is validated, how to configure it in the Intune admin center, and what prerequisites and rollout status apply, based on Microsoft’s current Intune documentation.

What is an elevation system settings policy?

According to Microsoft’s Intune documentation, EPM can be configured using three policy types, each of which can be assigned to groups of users or devices:

• Elevation settings policy – controls the EPM client itself, including whether EPM is enabled and what the default elevation response is for unmanaged files.
• Elevation rules policy – defines how specific executable files, MSI packages, or PowerShell scripts are elevated.
• Elevation system settings policy – lets standard users change selected Windows system settings that normally require administrator rights.

The elevation system settings policy is the piece relevant to network configuration. Microsoft documents that this policy type currently supports a network settings category, which lets a standard user change IPv4, IPv6, and DNS server values for the network adapters on their device.

Which network settings are supported

Based on the Intune documentation, the network settings category covers:

• IPv4 configuration – including IP address, subnet mask, gateway, preferred DNS, and alternate DNS.
• IPv6 configuration – including IPv6 address, prefix length, gateway, preferred DNS, and alternate DNS.
• DNS server values – configurable as part of either the IPv4 or IPv6 settings for a given adapter.

Microsoft gives a practical example of why this matters: a user who travels between office locations may need to set a static IP address or DNS server to get a device online at a new site, even while the device is offline from the corporate network. Without this policy, that same user would be blocked by a standard UAC prompt.

Elevation type and validation options

For network settings, Microsoft’s documentation describes the elevation type as User confirmed — the user must act on a confirmation prompt before the change is applied. Administrators can then choose to require additional validation on top of that basic confirmation:

• Business justification – the user must enter a justification for the change. This justification is saved and can be reviewed later in Intune reporting.
• Windows authentication – the user must authenticate with their organizational credentials before the change takes effect.
• Both – administrators can require business justification and Windows authentication together.
• Neither – if no validation option is selected, the user only needs to confirm their intent to apply the change.

This gives administrators a way to balance user friction against the level of assurance they want before a network configuration change is applied.

Configuring an elevation system settings policy in the Intune admin center

Microsoft documents the following high-level configuration path for creating this policy:

1. Sign in to the Microsoft Intune admin center and go to Endpoint security > Endpoint Privilege Management > Policies tab > Create Policy.
2. Set Platform to Windows and Profile to Elevation system settings policy, then select Create.
3. On Basics, enter a descriptive policy name and an optional description.
4. On Configuration settings, add a rule:
   • Enter a Rule name (required) and an optional description.
   • Set System setting to Network settings.
   • Set Elevation type to User confirmed.
   • Optionally select Business justification, Windows authentication, or both under Validation.
5. On Scope tags, apply any scope tags your organization uses.
6. On Assignments, select the groups of users or devices that should receive the policy.
7. On Review + create, review the settings and select Create to save and assign the policy.

Once assigned, the policy appears in the Intune policy list with a policy type of Elevation system settings policy. After the device’s next policy sync, affected users gain access to the configured network settings through the Windows Company Portal.

Prerequisite: an elevation settings policy must also be in place

Microsoft’s documentation is explicit that an elevation system settings policy alone is not enough. For the network settings elevation to actually take effect on a device, that device must also be targeted by a separate elevation settings policy that enables EPM itself. If EPM isn’t enabled on the device through this prerequisite policy, the network settings capability has no effect, regardless of how the elevation system settings policy is configured.

In practice, this means rolling out network settings elevation is a two-policy exercise:

• An elevation settings policy that turns EPM on for the device (and configures client-level behavior such as default elevation response and reporting).
• An elevation system settings policy that defines the network settings rule and its validation requirements.

Licensing and platform prerequisites

Microsoft’s EPM overview states that before you can use any Endpoint Privilege Management policies — including elevation system settings policies — you must license EPM in your tenant. The overview points administrators to Microsoft’s Intune advanced capabilities documentation for licensing details, but the specific licensing terms or SKUs are not covered in the EPM documentation itself, so they aren’t repeated here. Administrators should confirm current licensing requirements through Microsoft’s official Intune advanced capabilities guidance before planning a rollout.

On the platform side, Microsoft’s documentation for both the EPM overview and the system settings management article state that EPM, including the network settings capability, applies to Windows devices.

What end users see in the Company Portal

Changing these settings is documented as an end-user task performed in the Windows Company Portal, not something administrators do on the user’s behalf from the Intune admin center. According to Microsoft’s documentation, once a device has an assigned elevation system settings policy and completes its next policy sync, the user experience is:

1. In the Windows Company Portal, the user goes to Help & support, and in the System settings tile selects Edit settings. This tile acts as a single entry point for any system settings categories EPM manages on that device.
2. An Endpoint Privilege Management – Network Settings window opens, listing the device’s available network adapters (for example, Ethernet). The user selects an adapter.
3. The adapter details show current IPv4, IPv6, and DNS values along with hardware properties. The user selects Edit next to the section they want to change.
4. The user chooses how the setting is assigned:
   • Automatic (DHCP) – the adapter obtains values automatically.
   • Manual – the user enters values directly, such as IP address, subnet mask, gateway, preferred DNS, and alternate DNS for IPv4, or the equivalent IPv6 fields.
5. The user selects Save. Depending on the validation options configured in the policy, the user may need to provide a business justification, authenticate, or both before the change is applied.

Because this is a user-facing workflow, it’s worth sharing these steps directly with affected staff so they understand what the prompts mean and why they’re appearing.

Rollout status

Microsoft’s documentation includes an explicit note that EPM system settings for network settings is rolling out gradually and may not yet be available in every tenant. Administrators who don’t see the Elevation system settings policy profile option in the Intune admin center today should not assume their configuration is wrong — the capability may simply not have reached their tenant yet.

Practical recommendations for SMB administrators

The following points are practical guidance based on the documented behavior above, not documented Microsoft requirements:

• Pilot with a small group first. Since this feature is still rolling out, test the elevation system settings policy with a pilot group of mobile or multi-site users before assigning it broadly, since they are most likely to benefit from adjusting network settings outside a managed network.
• Decide on validation requirements deliberately. Requiring Windows authentication adds assurance that the person making the change is the authenticated user, while business justification creates an auditable record. Consider which (or both) your organization needs based on how sensitive network configuration changes are in your environment.
• Confirm the elevation settings policy is assigned before troubleshooting. If users report that the Company Portal network settings tile isn’t appearing, check first whether the device also has the prerequisite elevation settings policy assigned and has synced, since the system settings policy alone won’t take effect.
• Communicate the end-user workflow in advance. Because the entire experience takes place in the Company Portal rather than through a traditional Windows network settings dialog, give users a short walkthrough so unfamiliar prompts (confirmation, justification, or authentication) don’t cause support tickets.

Conclusion

Intune’s elevation system settings policy gives administrators a documented way to let standard users adjust IPv4, IPv6, and DNS configuration without granting full administrator rights or deploying extra tooling. The feature relies on a clear configuration model — a network settings rule with a User confirmed elevation type, optional business justification and Windows authentication validation, and a prerequisite elevation settings policy that enables EPM on the device. Because Microsoft describes this capability as rolling out gradually, SMB administrators should verify its availability in their own tenant, confirm licensing through Microsoft’s Intune advanced capabilities documentation, and pilot the configuration with a representative group of users before wider deployment. As with any EPM policy, this draft should be reviewed against your organization’s current Intune admin center experience before rollout, since gradual rollouts can mean the feature’s availability changes over time.