# Create EPM Policy Last Updated On: 27 Jul 2026 7 minutes read Build a Privileged Application List, choose an elevation mode, and define the applications or rules that govern how users gain elevated access. ## Prerequisites Before creating an EPM policy, ensure the relevant applications are included in the allowlist. Only allowlisted applications can be elevated. ## Overview ## How EPM policy creation works Privilege elevation is controlled through a Privileged Application List that is then associated with specific device groups. ### The policy creation workflow Implementing privilege management in Endpoint Central MSP starts with creating an EPM policy that governs how users access and run applications with elevated rights. Administrators define a **Privileged Application List** — the set of applications requiring administrative access — then associate that list with specific custom groups containing the user devices that need the elevated access. Once deployed, selected users can run approved applications with elevated privileges while retaining standard user rights everywhere else. ## Setup ## Create Privileged Application List Choose an elevation mode and scope it to all or specific applications. Navigate to **Application Control -> Privilege Management** and click **Create** for a new list or **Modify** to update an existing one. ### Self-elevation: Allow users to elevate on reason The **Allow users to elevate applications on reason** option lets users elevate specific applications by providing a justification. The justification is logged and accessible under **Reports → Applications Elevated with Reason Report**. ![Self elevation with reason policy configuration](https://www.manageengine.com/products/desktop-central/help/images/ac-pm-self-elevation.png) Here is the notification shown in the endpoint when the user tries to self-elevate an application: ![Self-elevation prompt shown on the endpoint when a user attempts to elevate an application](https://www.manageengine.com/products/desktop-central/help/images/self-elevation-com.png) Self-elevation prompt — the user provides a reason before elevation proceeds. **Note** For details on how the self-elevation notification appears to end users, refer to the [end-user notifications page](https://www.manageengine.com/desktop-management-msp/help/application-control/ac-enduser-notifications.html#self-elevate). ### Self-elevation: Allow users to elevate on request (JIT) The **Allow users to elevate applications on request** option enables users to request Just-In-Time elevation for a specific time duration, with a mandatory justification. Each request is routed to an administrator for approval before elevation is granted. [Learn more about user-initiated elevation requests](https://www.manageengine.com/desktop-management-msp/help/endpoint-privilege-management/epm-jit-access.html#jit-request) ![Elevation on Request](https://www.manageengine.com/products/desktop-central/help/images/ac-pm-elevate-request.png) ### Elevation to all allowed applications When this option is selected, the custom groups associated with the Privileged Application List during policy deployment can self-elevate privileges to all allowlisted applications — no per-application selection needed. ![Elevation for Allowed Applications](https://www.manageengine.com/products/desktop-central/help/images/ac-pm-elevation-allowed-apps.png) ### Elevation to specific applications When this option is selected, privilege elevation is scoped to only the applications explicitly chosen. Specific applications can be added using rule types including **Vendor**, **Products**, **Verified Executable**, **File Hash**, **CLSID**, and **Folder Path**. Learn more about configuring specific applications for elevation [below](https://www.manageengine.com/desktop-management-msp/help/endpoint-privilege-management/epm-policy-creation.html#specific). ![Elevation for Specific Applications](https://www.manageengine.com/products/desktop-central/help/images/ac-pm-specific-apps.png) **Note** To see which file extensions each rule type supports, refer to the [rule type extension support table](https://www.manageengine.com/desktop-management-msp/help/endpoint-privilege-management/epm-how-it-works.html#rule-support). ### Auto Elevation With Auto Elevation enabled, applications in the associated groups run automatically with elevated privileges — no user prompt or request required. Use this for trusted, recurring administrative tools where the overhead of manual elevation would impede productivity. ![Auto Elevation](https://www.manageengine.com/products/desktop-central/help/images/ac-pm-auto-elevation.png) ## Rules ## Selecting Specific Applications and Custom Rules Fine-grained rule types let you scope elevation to precisely the right executables. ### Available rule types for specific application elevation When scoping elevation to specific applications, choose from the following rule types: **[Vendor](https://www.manageengine.com/desktop-management-msp/help/application-control/configure-app-groups.html#trusted-vendors)**, **[Products](https://www.manageengine.com/desktop-management-msp/help/application-control/configure-app-groups.html#product-name)**, **[Verified Executable](https://www.manageengine.com/desktop-management-msp/help/application-control/configure-app-groups.html#verified-executables)**, **[File Hash](https://www.manageengine.com/desktop-management-msp/help/application-control/configure-app-groups.html#file-hash)**, **CLSID**, and **[Folder Path](https://www.manageengine.com/desktop-management-msp/help/application-control/configure-app-groups.html#folder-path)**. The **CLSID rule type** controls COM object elevation by referencing the unique Class ID of each component rather than an executable or path. This applies elevation rules directly to Windows system components or registered COM objects — reducing reliance on mutable file attributes and providing granular control over built-in OS functions. ![CLSID filter configuration screen for EPM specific application elevation](https://www.manageengine.com/products/desktop-central/help/images/epm-cls-id.png) CLSID rule type — target COM objects by Class ID for precise OS-level elevation control. ### Creating custom rules Custom rules can be defined for applications not yet detected in your network. Click **Add** under the relevant rule type to specify criteria such as vendor, product name, verified executable, file hash, or CLSID manually. ![EPM Custom Rule creation dialog for defining application elevation criteria manually](https://www.manageengine.com/products/desktop-central/help/images/epm-custom-rule.png) Custom Rule — define elevation criteria for applications not yet discovered in the network. ## Related - [EPM policy deployment](https://www.manageengine.com/desktop-management-msp/help/endpoint-privilege-management/epm-policy-deployment.html) - [JIT access for privilege elevation](https://www.manageengine.com/desktop-management-msp/help/endpoint-privilege-management/epm-jit-access.html) - [Rule type extension support](https://www.manageengine.com/desktop-management-msp/help/endpoint-privilege-management/epm-how-it-works.html#rule-support) - [Privilege Management FAQ](https://www.manageengine.com/desktop-management-msp/help/endpoint-privilege-management/epm-faq.html)