Monitor Pending Epm Requests Scheduled

Alert by email about pending EPM elevation requests

This is a scheduled runbook. It is designed to run on a recurring schedule rather than being triggered for a single object. See Scheduling for details on how to configure runbook schedules.

Description

Checks Intune for Endpoint Privilege Management elevation requests that are still waiting for a decision and sends an email when there are any, so approvers do not miss them. The email can carry a table with the request details and the report files. The report can be sent by email or provided as a download link.

Endpoint Privilege Management context

• Endpoint Privilege Management (EPM) allows users to request temporary admin rights for specific applications.
• Pending requests require manual review and approval by security admins.
• Requests expire automatically if they are not reviewed within the configured timeframe.
• A timely review is critical for user productivity and for the security posture.

Scheduling

An hourly schedule is recommended.

Email behaviour

• Emails are sent individually to each recipient.
• No email is sent when there are no pending requests.
• Report file attachments (see ReportFileFormat) are only included when DetailedReport is enabled.

Setup regarding email sending

Sending an email report is optional and only happens when a recipient (EmailTo) is provided. The sender address is taken from the RJReport.EmailSender tenant setting.

This runbook sends emails using the Microsoft Graph API. To send emails via Graph API, you need to configure an existing email address in the runbook customization.

See the RealmJoin Report Settings documentation for details on all available settings.

Email branding

The report email honors the optional RJReport.Branding.* tenant settings:

• Header and footer image – public HTTPS URLs, PNG/JPEG/GIF, max. 200 KB each
• Footer link – target of the footer image
• Accent and text color – 6-digit hex values, e.g. #0052cc

When these settings are not configured, the default RealmJoin graphics and colors are used. An image that cannot be downloaded or validated, or an invalid color value, never prevents the report email – the corresponding default is used instead.

Setup instructions and image requirements: Email branding.

Location

Organization → Security → Monitor Pending EPM Requests (Scheduled)

Full Runbook name

rjgit-org_security_monitor-pending-EPM-requests_scheduled

Details

Property	Value
Version	1.3.0
Required modules	RealmJoin.RunbookHelper (>= 0.8.9) Microsoft.Graph.Authentication (>= 2.39.0) Az.Accounts (>= 5.5.2)
Schedulable	yes

Permissions

Application permissions

• Type: Microsoft Graph

  • DeviceManagementConfiguration.Read.All

    • Queries Endpoint Privilege Management elevationRequests with status 'Pending' to detect requests awaiting approval
  • Mail.Send (optional — feature: Email report)

    • Sends the pending-requests alert email via Send-RjReportEmail when EmailTo is configured

Parameters

DetailedReport

Adds a table with every pending request and attaches the report files. Otherwise the email only states how many requests are pending.

Property	Value
Required	false
Default Value	False
Type	Boolean
Portal display name	Include request details?

EmailTo

Send the report to these addresses. Separate several with commas; each recipient gets a separate email.

Property	Value
Required	false
Default Value
Type	String
Portal display name	Recipient email address(es)

EmailFrom

Sender address of the report email. Taken from the tenant setting RJReport.EmailSender.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

BrandingHeaderImageUrl

Header image of the report email (HTTPS URL, PNG/JPEG/GIF, max 200 KB). Taken from the tenant setting RJReport.Branding.HeaderImageUrl; the default RealmJoin header is used when empty.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

BrandingFooterImageUrl

Footer image of the report email (HTTPS URL, PNG/JPEG/GIF, max 200 KB). Taken from the tenant setting RJReport.Branding.FooterImageUrl; the default RealmJoin footer is used when empty.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

BrandingFooterLink

Link behind the footer image of the report email. Taken from the tenant setting RJReport.Branding.FooterLink; realmjoin.com is used when empty.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

BrandingAccentColor

Accent color of the report email as a 6-digit hex value. Taken from the tenant setting RJReport.Branding.AccentColor; the RealmJoin default is used when empty or invalid.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

BrandingTextColor

Text color of the report email as a 6-digit hex value. Taken from the tenant setting RJReport.Branding.TextColor; the RealmJoin default is used when empty or invalid.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

ReportFileFormat

Deliver the report as CSV, as an Excel workbook, or both.

Property	Value
Required	false
Default Value	CSV & XLSX
Type	String
Portal display name	Report file format

Portal options

Portal option	Value
CSV & XLSX	CSV & XLSX
CSV only	CSV only
XLSX only	XLSX only

CreateDownloadLink

Also upload the report and return a download link that expires after a few days.

Property	Value
Required	false
Default Value	False
Type	Boolean
Portal display name	Create a download link?

Portal options

Portal option	Value
Yes - upload report and return a download link	true
No - do not create a download link	false

ContainerName

Storage container the report files are uploaded to. Set per runbook.

Property	Value
Required	false
Default Value	monitor-pending-epm-requests
Type	String
Hidden in portal	yes (preset via runbook customization)

ResourceGroupName

Resource group of the storage account for report uploads. Taken from the tenant setting RJReport.StorageAccount.ResourceGroup.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

StorageAccountName

Storage account for report uploads. Taken from the tenant setting RJReport.StorageAccount.StorageAccountName.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

LinkExpiryDays

Number of days a download link stays valid. Taken from the tenant setting RJReport.StorageAccount.LinkExpiryDays.

Property	Value
Required	false
Default Value	6
Type	Int32
Hidden in portal	yes (preset via runbook customization)

Back to Runbook Reference overview