Our Windows users are standard users on Intune-managed devices. Is there a Microsoft-native way for them to request approval for an installer and run it elevated without someone remoting in or giving them permanent local admin rights?
Company Portal covers some common apps, but we also have occasional one-off installs. Does Endpoint Privilege Management handle those, or would we need another tool?
Look at Intune Endpoint Privilege Management and its support-approved elevation workflow. It is intended to let a user request elevation and an administrator review the request, rather than making the user a permanent local admin.
There was some disagreement about whether it covers every arbitrary installer without a rule configured first, so test the exact one-off workflow you need before committing to it. Also check the licensing and configuration requirements for your tenant.
For the software people ask for regularly, package it in Intune and publish it as an available app in Company Portal. Users can install those themselves, and IT gets to choose what goes into the catalog.
That won't eliminate one-off requests, but it should leave fewer of them to review. Pair the catalog with an exception process for new apps and department trials.
There are third-party endpoint privilege tools worth evaluating too. Admin By Request, AutoElevate and BeyondTrust are examples to compare against EPM if ad hoc installer approval is the main requirement.
I'd run a small test with an installer you haven't preapproved. Check what the user sees, what the approver can review, and whether the elevation applies to the installer rather than granting broader admin access.
Before picking a tool, decide what approval actually means. If every request gets approved automatically, you may have made installing anything easy without much of a security check.
For unfamiliar software, someone should be able to consider the business need and risk. A broad rule that lets users elevate anything is a very different choice from approving a specific installer.
Skipperoo:
The goal is to avoid a remote session for each install, not necessarily to skip review of the software.
A time-limited local admin assignment is another direction, potentially using group membership and privileged access management. But that's broader than elevating one installer, so I'd treat it as a separate exception workflow rather than the default for software requests.
Answers are reviewed before publication.
Norky:
The approval still takes someone's time, but it can remove the need to remote into the device and type admin credentials.