New settings for Administrator protection in endpoint security Account Protection policy

What changed

These settings enhance device security by requiring user authentication for administrator level actions. This authentication request helps to safeguard devices from unauthorized changes and malware.

Why it matters

Administrator Protection adds user authentication to privileged actions and can change elevation behavior for administrators, installers and support tools on managed Windows devices.

Known limitations

• Availability, prerequisites and rollout scope remain authoritative in the linked Microsoft documentation.

Now check

• Confirm supported Windows builds and the two Administrator Protection settings in the Endpoint security Account Protection profile
• Pilot approval-mode and elevation-prompt behavior with standard admin, software-installation and helpdesk scenarios
• Validate authentication prompts, application compatibility, policy conflicts, reporting and emergency rollback