Endpoint Privilege Manager and Identity Governance
Endpoint Privilege Manager and Identity Governance
This domain tests least privilege on endpoints and governed access to entitlements. Expect EPM policy design, elevation and application control, plus access requests, certifications, roles, and separation of duties in Identity Governance.
Core rules
- EPM removes standing local admin rights. Users get elevated privileges only for approved applications, publishers, or actions, with audit evidence.
- EPM rules can match publisher, product, file hash, path, or command line. Publisher rules survive patching; hash rules are precise but break on every update. Path-only rules are usually too broad.
- Application control blocks or allows execution; privilege elevation raises the token for a specific process. Threat protection and credential theft protection add behavior-based controls.
- Identity Governance covers the request-to-certification lifecycle: access requests, approvals, provisioning, periodic certifications, role and entitlement models, and separation-of-duties checks.
- Governance must include machine and privileged entitlements, not only standard user accounts. Certification without revocation is only paperwork.
Worked example
A finance user needs a signed tax application that requires admin rights. Create an EPM elevation policy matching the vendor publisher and product, not powershell.exe and not an open path. Allow elevation only for that executable, log the launch, and require a business justification. In Identity Governance, model the app entitlement, require manager approval, and include it in the quarterly certification. Reasoning: publisher matching survives version updates; the user never receives standing admin; the entitlement has an owner and a review trail. If the vendor certificate changes, the rule fails closed and is corrected deliberately.
Traps
- Writing a hash-only rule and then treating a patched app as a security incident.
- Allowing a scripting host by path, which permits arbitrary code.
- Granting permanent admin because EPM policy tuning is difficult.
- Running certifications with no entitlement owner or no revocation step.
- Missing separation-of-duties conflicts when roles are combined.