This blog will be small and simple, but it will be about me looking at how the Endpoint Privilege Management reports will be delivered to Intune. Oww did I said simle? My bad…
1. Introduction
If you have enabled Endpoint Privilege Management (EPM) in your tenant and, with it, getting your device enrolled into MMPC (Microsoft Managed Platform – Cloud), I bet you also configured the Elevation Settings policy and defined the “Send Data to Microsoft” section.
![Afbeelding met tekst Automatisch gegenereerde beschrijving](https://call4cloud.nl/wp-content/uploads/2023/04/afbeelding-met-tekst-automatisch-gegenereerde-bes-11.png)
When you have configured this reporting section, the device its Telemetry data is sent over to Microsoft and the Device Health Monitoring Policy will be deployed to your device.
![](https://call4cloud.nl/wp-content/uploads/2023/04/word-image-14444-2.png)
If you decide to elevate some stuff (or not) like PowerShell this information should be sent over to Microsoft once in a while…..(it should…really..)
![](https://call4cloud.nl/wp-content/uploads/2023/04/word-image-14444-3.png)
As shown below the Endpoint elevation report should eventually end up on your tenant.
![](https://call4cloud.nl/wp-content/uploads/2023/04/image-51.png)
Somehow, “Something went wrong” in the backend a couple of weeks ago, and the data wasn’t there. As shown below, I am missing something in between….
![Afbeelding met tekst, tafel Automatisch gegenereerde beschrijving](https://call4cloud.nl/wp-content/uploads/2023/04/afbeelding-met-tekst-tafel-automatisch-gegeneree.png)
Of course, the product is still being worked on so no complaints here but somehow that “delay” got me triggered. I wanted to know the exact flow of what was happening between performing the Elevation itself and the data being sent over
2. The Flow
I started writing it all down, but it became too complex to describe each step after a while, so I trusted in my magical MSPaint skills.
Please Note: I am not a Microsoft Engineer with inside knowledge, so I am only trying to solve the puzzle. Maybe it will help you understand what is happening behind the reporting curtains.
![Endpoint Privilege Management Reporting Flow](https://call4cloud.nl/wp-content/uploads/2023/04/reporting-epm-1.bmp)
When looking at the Flow itself, I guess the most important parts are the WMI Autologger SensorFramework and the ListenerFramework which will get the EPM data and make it ready for transport.
Please leave me a note if I need to write the whole process down instead of showing you 1 big flow
Conclusion
I truly love the stuff Endpoint Privilege Management brought us! I love the MMP-C, the EPM Agent, the Windows Declared Configurations, and the EPM Reports, too!
![](https://call4cloud.nl/wp-content/uploads/2023/04/giphy-1.gif)