Intune EPM vs Admin By Request: what's really different

Since July 2026, Intune EPM has been included in Microsoft 365 E5 at no extra cost. Organizations already paying for E5 are asking, fairly, why they should buy another EPM solution.

To answer that fairly, we went through the official documentation of both products, on Microsoft Learn and in the Admin By Request documentation center, focusing on Windows. We then added the differences the vendor highlights, such as macOS and Linux support. The goal isn't to prove that one product is better, but to show where each one fits.

What Microsoft's own documentation says about Intune EPM

Every limitation in this section comes from Microsoft's official documentation on Microsoft Learn, not from competitors' marketing material.

Supported endpoints

Only endpoints that are Entra joined or hybrid joined, and enrolled in Intune or co-managed with Configuration Manager (prerequisites). Workgroup, on-premises-domain-only and registered (Workplace Joined) endpoints aren't supported (known issues).
Only 64-bit Windows 10 and Windows 11. Windows Server isn't supported.
In virtual environments, only single-user Windows 365 and AVD machines are supported (FAQ).
EPM doesn't work on a network with SSL inspection unless its addresses are excluded from inspection.

What can run elevated

Only exe and msi files and PowerShell scripts. UWP apps aren't supported.
Control Panel items and Windows Settings can't run elevated. Microsoft's workaround is to package them as scripts.
Files on a network share or a mapped drive aren't supported.
An elevated app runs under an isolated virtual account, so it can't reach network folders, OneDrive, SharePoint or Azure. The workaround, running as the current user, increases the attack surface, according to Microsoft.
Only one file can run at a time, and the elevation option doesn't appear in the right-click menu for Start menu and taskbar items.

The approval process

An approved request is valid for exactly 24 hours. You can't set a different duration or revoke an approval before it expires (support approvals).
When a request is denied, the user isn't notified. An admin has to tell them manually.

Reporting and management

Report data is processed once every 24 hours and kept for only 30 days (reports).
Default settings apply to the device, not the user, even when assigned to a user group.
When EPM is turned off on a device, its components are removed only after 7 days.
EPM doesn't manage users who still have admin rights on the device at all, and isn't currently compatible with Windows Administrator Protection.

What Admin By Request has that Intune doesn't

The capabilities in this section come from Admin By Request's official documentation and refer to the Windows version.

Broader endpoint coverage

Support for endpoints without Active Directory, multiple domains and Entra-joined endpoints, side by side (Windows spec sheet). Since version 8.7, registered Entra accounts are supported too (release notes).
Windows 10 and later on x86, x64 and ARM64, plus Windows Server from 2008 R2 with the desktop experience (editions and features).
No Intune requirement. You can deploy the agent through Intune, SCCM or any other deployment tool.

More flexible elevation

Rules by file location, including network shares.
Admin Session: temporary admin rights on the whole endpoint, for tasks that take several actions in a row. Since version 9.0 you can also end a session remotely from the portal.
Tray Tools: OS tools such as Control Panel and adding a printer run with admin rights straight from the agent's menu.

Working offline

A user without internet access gets a one-time PIN code from IT, using challenge and response. The code is valid for one request only, and the audit log syncs to the portal when the endpoint is back online.

Security

Every file scanned with OPSWAT MetaDefender before it runs elevated.
Blocking system files such as cmd.exe or regedit.exe from running elevated, including their child processes (Windows settings). This closes the loophole where a user uses elevation for CMD or PowerShell to create an admin account for themselves.
Device Owner: you can block elevation for anyone who isn't the endpoint's primary user, meaning the first non-admin user who signed in to it. That matters especially on shared endpoints. In Intune, by contrast, any user on the endpoint can submit a request.
A blackout period after malware detection. When malware is detected on an endpoint, the user can't request new elevation for a period the organization sets, in minutes (Windows settings). Available since version 9.0.
Ending an Admin Session when malware runs. If a user runs a malicious file inside an Admin Session, the file is blocked, the whole session closes immediately, and IT gets an email alert (malware detection).
Version ranges in pre-approvals. You can limit a pre-approval to a minimum and a maximum app version (Windows portal management). A minimum version stops old versions with known vulnerabilities from running, and a maximum version stops a new, untested version from being approved automatically. In Intune you can only set a minimum version (elevation rules).
Protection against clock changes. The system detects a change to the endpoint's clock and closes the session immediately, so users can't extend their own elevation time.

Support and day-to-day work

Support Assist: a technician gets temporary rights inside the user's session, without standing admin rights.
Break Glass: a one-time, time-limited local admin account for emergencies.
A mobile app for approving requests, and an audit log that's available in the portal without a processing delay.

More advantages the vendor highlights

Beyond what we found in the documentation, Admin By Request highlights several more advantages in its own comparison article (full article):

Multiple operating systems. Intune EPM only works on Windows. Admin By Request manages Windows, macOS and Linux from the same portal, with the same policy. On macOS it recently added managed sudo for command-line tools.
A small agent. The Admin By Request agent is under 3MB, compared with an Intune extension of more than 20MB. The same agent also runs Secure Remote Access and Web Access Management, so there's no extra agent.
Faster policy updates. According to the vendor, a policy change reaches endpoints without waiting for a sync cycle, compared with 20 to 30 minutes in Intune.
Bypass protection. Once installed, Admin By Request is the only way to get admin rights, and users can't remove or bypass it with the rights they were given. Every elevated run is logged, including the full process tree.
Management at scale. Instead of a separate policy for each group, you set a global default and layers of exceptions by department, location or need.
Automation. AI and machine-learning auto-approval, and an app for approving requests from your phone.
Support included. Support is included in the per-endpoint price, with a first response within one business day. With Intune, support goes through Microsoft's general channels.
Flexible deployment. You can deploy the agent through Intune, SCCM or Jamf, and you don't need Intune at all.

Keep in mind that these are the vendor's claims. Test whatever matters most to you yourself, for example in a pilot on the free plan.

At a glance

Topic	Intune EPM	Admin By Request
Operating systems	Windows only	Windows, macOS and Linux from one portal
Agent size	Extension of more than 20MB	Under 3MB
Policy updates on endpoints	20 to 30 minutes	No wait for a sync cycle
Device join types	Entra or hybrid only	Workgroup, on-premises domain, hybrid, Entra, Entra registered
Windows Server	Not supported	Supported from 2008 R2
32-bit systems	Not supported	Supported
AVD	Single-user only	Multi-user too
Intune required	Yes, or co-management with SCCM	No
Files on a network share	Not supported	Supported
Control Panel and Windows Settings	Can't run elevated	Through Tray Tools
Temporary rights on the whole endpoint	None	Admin Session
Working offline	None	One-time PIN code
Approval duration	Fixed 24 hours, can't be revoked	Set in the portal, can be ended remotely
File scanning	None	OPSWAT MetaDefender
Blocking elevated CMD and PowerShell	Depends on how rules are designed	Dedicated setting, including child processes
Lockout after malware detection	None	Blackout period set by the organization
Malware inside an elevated session	None	Blocked, session closed, email alert
Versions in pre-approvals	Minimum only	Minimum and maximum
Limit to the device owner	No, any user can request	Yes
Rights for support staff	No dedicated mechanism	Support Assist
Emergency account	Through Windows LAPS, a separate tool	Built-in Break Glass
Report data availability	Processed once every 24 hours	No processing delay
Removing components from the endpoint	After 7 days	When the agent is removed
Policy management	A policy per group	Global default with layers of exceptions (Sub-Settings)
Smart auto-approval	None	AI and machine-learning approval
Mobile approval app	Portal only	iOS and Android
Technical support	Microsoft's general support channels	Included in the price, first response within one business day

The comparison is based on both products' official documentation as of October 2026. The rows on multi-user AVD and report data availability are based on Admin By Request materials.

When Intune EPM is enough

Intune EPM isn't the wrong choice for everyone. It can be enough for an organization that meets all of these conditions:

Every endpoint is 64-bit Windows 10 or 11, Entra or hybrid joined, and managed in Intune.
There's no need to support Mac, Linux or Windows Server.
The organization already pays for Microsoft 365 E5, so EPM is included.
The needs are basic: running known software, no offline work, and no need for temporary rights for support staff.

If any of these doesn't hold, or the organization is on E3 and would have to buy EPM separately, it's worth testing both products side by side. You can install Admin By Request free on up to 25 endpoints, including through Intune, and compare under real conditions.

Summary

Intune EPM is a basic solution that suits a homogeneous Microsoft environment. In mixed environments, in organizations with servers, endpoints without Entra or a need to work offline, and anywhere the support desk needs rights, its limits show quickly.

At OnCloud we work with both products and help customers choose by their environment, not by the license they already have. Want to find out what fits you?

Book a technical demo