Getting Started: End User Elevation

Evo End User Elevation enables users to send requests for administrative privileges to execute applications or installers even if their accounts do not have standing administrative rights. Upon submission, the request is forwarded to a technician for review, where it can be either approved or denied.

To simplify usage and administration, rules can be defined within the Evo Partner Portal to automatically approve or deny requests based on criteria about the application being requested and also be scoped to specific users, groups, endpoints, and tenants so that just the right people can do just the right things.

These instructions assume that you already have access to your Evo Partner Portal and have completed the basic steps to setup your MSP with Evo.

If not, head over to our MSP Onboarding Guide and compete the steps there first!

Note: In particular, these directions assume that the technicians that will respond to elevation requests already have access to the Evo Partner Portal and have the Evo Authenticator app installed. We recommend completing those steps before proceeding.

Training Mode allows the Evo Agent to be put into the field with End User Elevation enabled but prevents users from having to make requests for elevation via Evo. When deployed this way, users continue operating with the permissions they have always had but with the system recording each action that was undertaken using admin privileges.

After running for a period of time, those observations can then easily be turned into elevation rules in Evo for actions that you want to continue to allow, minimizing the user impact once Training Mode is disabled and admin rights are withdrawn from those users' accounts.

Note: If the Evo Agent is deployed with EUE turned on but without Training Mode enabled for that Tenant, users will immediately be required to send requests for elevation via Evo. If you don’t want that to happen until after you have built rules and prepared your users, we recommend starting with Training Mode turned on.

Note: With the Evo Agent deployed even in Training Mode, users will begin to see our custom UAC prompt. They will be able to just click through it as they have always been able to click through standard Windows UAC, this is just a small aesthetic change that users may notice even before EUE is fully enabled.

Note: When a user is running an application for the first time they will be prompted to enter their credentials. This is needed so we can run the applications as them and proceed with the Training Mode.

The Evo Endpoint Agent needs to be deployed to each endpoint on which Technician Elevation will be available as it facilitates the authentication of an Evo user into an administrator account on the target machine.

Refer to our Windows Agent Deployment article to complete that process.

End User Elevation is licensed per endpoint, so each endpoint that has the Evo Agent on it for purposes of facilitating EUE requests will need to have a license.

Note: Refer to our full article on managing user licenses for fuller details of how to manage Evo licenses.

The Evo Agent can be configured to display your MSP’s logo and other custom branding on the request and approval screens that users will see on their endpoints.

See our article on Custom EUE Branding for details on how to configure. This process can be completed at any time, so it may be something that you want to come back to later if you’re just getting started with testing EUE.

There are three ways to approach rolling out End User Elevation. The right path depends on your users and whether or not they currently have administrative rights and how you are currently managing elevation requests.

If Your Users Do Not Have Admin Rights

If your users already do not have administrative rights and are requesting assistance each time they need it, we recommend enabling End User Elevation without any pre-made rules. The users' experience will improve right away by automating the request experience, and you can build a rule set over time to gain more efficiency in serving those requests.

If Your Users Do Have Admin Rights

If your users do have administrative rights, then rolling out Evo End User Elevation will be a part of your overall project plan for reducing those users' administrative rights.

The overall process is to build rules that will automatically approve the most common things that users can and should be allowed to do using elevated permissions. Think about things like software updaters, installers for approved programs, and other common actions.

The data from Training Mode gives you visibility into what actions users are currently taking with admin privileges before removing any admin privileges. You can then use that visibility to build rules to permit or deny actions before actually changing anything for the users.

If You Are Replacing An Existing Elevation Solution

If you are replacing an existing admin elevation solution and want to duplicate your existing rules, we recommend duplicating your existing rules in Evo before migrating endpoints to Evo End User Elevation.

We do not currently support the automated migration of rules from other solutions (and it is typically difficult to do so because that rule data is typically not readily available from other vendors.) But please contact Evo Support if you have specific questions about the migration process or are interested in working with us to develop an automated migration path.

Note: We do not recommend deploying Evo until the previous elevation solution has been removed from the endpoints as having multiple solutions trying to simultaneously manage processes like Windows User Access Control may cause unpredictable behaviors.

To configure automatic approval for specific applications when a user requests End User Elevation, rules can be created in one of two ways.

Creating A Rule From A Request or From Training Data

Creating A Manual Rule

You can also create rules by dragging-and-dropping files directly into the Evo Portal. Navigate to the Rules tab and select “Create Rule.”

Here, you can upload executable files such as .exe, .dll, .scr, or .msi, and the system will automatically extract and populate the application details. Based on the extracted information, you can select the relevant attributes for rule creation by checking the corresponding boxes.

Technicians will need permissions for Elevation Requests as well as to particular Tenants in order to field EUE requests from those tenants.

We recommend adding the Elevation Requests set of permissions (or a sub-set according to your preferences and security policies) to an appropriate Role already defined for technician users who will manage elevation requests.

There are two methods of technician notification for new EUE requests: push notifications to the Evo Authenticator app and email.

Mobile Push Notifications

All technicians configured with the permissions described above who have the Evo Authenticator app running in Technician Mode will receive push notifications of new EUE requests.

Notifications can be managed or disabled from the Evo Authenticator app under Settings > Notification Settings.

Email Notifications

Email notifications are managed from the Evo Partner Portal.

To fully enable End User Elevation, we will just turn off Training Mode for the relevant Tenant(s). Once this is done, your users will begin to see Evo prompts to request admin actions and provide a reason for the request for your team to review.

🎉 Congratulations! Evo End User Elevation is now enabled! 🎉

The final step in improving your MSP’s security is to remove the administrator permissions from standard user accounts.

You have now dramatically improved the security posture of your MSP and customers - and also improved your users’ experience by providing a clean, delightful way to request permissions when needed without having to submit a ticket.

Please reach out to Evo Support with any questions!