A hands-on Microsoft lab demonstrating how temporary local administrator access can be granted only to approved users, for a limited time, and only on authorised managed Windows devices.
Lab environment: This project was completed independently in a personal Microsoft lab. All names, accounts and device information shown in the documentation are lab data.
| Area | Implementation |
|---|---|
| Business requirement | Allow support staff to complete privileged tasks without permanent administrator rights |
| Identity control | Microsoft Entra Privileged Identity Management |
| Device control | Microsoft Intune Account Protection |
| Approval controls | MFA, justification and approver authorisation |
| Access duration | One-hour activation with automatic expiry |
| Device scope | Approved managed devices only |
| Security principle | Zero Trust and least privilege |
Support administrators sometimes require elevated permissions to install software, change protected settings or complete troubleshooting. Permanent administrator access creates unnecessary risk, while granting the same elevated access across every device increases the potential impact of credential compromise.
This project tested whether privileged access could be:
- Eligible rather than permanently active
- Protected by MFA, justification and approval
- Automatically removed after a defined period
- Restricted to specifically approved managed devices
- Blocked on devices outside the authorised scope
- Created an Endpoint-Admins security group for users eligible to request temporary administrator access
- Configured group membership as eligible through Microsoft Entra PIM
- Required MFA before activation
- Required the requester to provide a justification
- Required approval before access became active
- Limited activation to one hour
- Enabled automatic privilege removal when the activation period expired
- Created an Approved-Admin-Devices device group
- Created an Intune Account Protection policy
- Added active members of Endpoint-Admins to the Windows local Administrators group
- Assigned the policy only to Approved-Admin-Devices
- Kept all devices outside that scope excluded from the elevated-access configuration
| Test | Expected result | Observed result |
|---|---|---|
| Administrative task before PIM activation | Blocked | Blocked |
| Activation without completing required controls | Not permitted | Not permitted |
| Administrative task on approved device after activation | Allowed | Allowed |
| Same activated account on an unapproved device | Blocked | Blocked |
| Administrative task after activation expiry | Blocked | Blocked |
The lab validated that an eligible support administrator could request and receive temporary local administrator access on an approved endpoint while remaining blocked on an unapproved device.
The solution reduced the risks associated with:
- Permanent administrative privileges
- Excessive device scope
- Uncontrolled privilege activation
- Lateral use of an elevated account
- Privileges remaining active after the task was completed
- Microsoft Entra ID
- Privileged Identity Management
- Microsoft Intune
- Account Protection policies
- Security-group and device-group scoping
- MFA and approval workflows
- Role-based access control
- Least-privilege design
- Test planning and technical validation
- Security documentation
View the full technical documentation (PDF)