Guides

How AdminExplorer works and how to set it up: descriptions, example configurations and flow diagrams. The same guides are available in the portal under Guides.

• Getting started: Onboard a tenant, download the configured client, deploy it with Intune and check that the first device appears in your portal.
• How AdminExplorer elevates: Pre-approved programs versus on-demand requests, the decision order, the reason prompt, approval modes Auto and Manual, and what the user sees.
• Policy guide with example configurations: Approved applications, rules, denied paths and settings explained, with copyable examples and starter policies for an office and for developers.
• Any application on demand and the secure-desktop confirmation: The Enterprise setting that lets users elevate programs without an approved entry or rule, its safety rules, the user-writable folder rule and the confirmation prompt.
• Microsoft Entra sign-in for your admins: Connect your own Microsoft Entra directory, verify the connection, control who signs in with assignment and Conditional Access, and optionally require Entra sign-in.
• Entra group targeting and Directory Sync: Assign applications, rules and Run in sandbox to Microsoft Entra groups, connect Directory Sync with admin consent, and how devices behave offline.
• Using your own app registration: Use one single-tenant app registration in your own Microsoft Entra for portal sign-in and group sync, authenticated with a certificate the portal holds. Setup script, validation, activation, sign-in link and renewal.
• Installed software tracking: What the device collects from Add/Remove Programs, how changes are linked to elevations and how strong that link is, and what is stored.
• Run in sandbox: Let users open untrusted files in Windows Sandbox, a disposable virtual machine, without administrator rights on the device. Requirements, switches and limits.
• Local administrator removal and protection: Remove standing local administrator membership and keep it removed, with report and enforce modes, presets, exceptions, a preview and a lock-out guard.
• Audit and reports: What every elevation record contains, how to filter and export it, the per-device and per-user summaries, and how long records are kept.
• Troubleshooting: Event ids on the device, common reason codes, an app missing from the menu, a device that does not enroll, and Sync now.
• Security model overview: What runs as SYSTEM on the device, what the driver does, how the portal and devices trust each other, what the portal stores, retention and data deletion.