- Platforms
- Windows
- Products
- Admin By RequestIntuneEntra ID
- Result
- Standard users on chosen devices elevate with a confirmation prompt, others still authenticate
Overview
Let trusted users confirm admin elevation with a simple Yes or No instead of typing credentials, by setting the Admin By Request UAC mode per group of devices.
FastTrack Software, the developer of Admin By Request (ABR), redesigned the User Account Control (UAC) prompt that asks a standard user for credentials. Version 7.0, with a new Windows client, made requesting admin rights much smoother for users.
The key change is that you now control what the UAC prompt looks like when a standard user selects Run as administrator. In the ABR portal (adminbyrequest.com) you choose between a login prompt asking for credentials (as before) and a simple confirmation (Yes/No). You can give the confirmation to everyone or only to trusted users and devices that need admin rights often.
For all new features of that release, see the ABR blog What's new in Admin By Request 7.
Prerequisites
Before you start, check that you have the following.
| Area | What you need | Docs |
|---|---|---|
| Licence | Admin By Request, paid or free plan (25 seats). One seat per device with the client installed | Free plan |
| Admin role | Admin By Request portal administrator, to change Windows settings and sub settings | Windows settings |
| Admin By Request | Admin By Request client deployed with Intune and the portal connected to Microsoft Entra ID (see my post Integrate Admin By Request with Microsoft Entra ID and Intune) | Release notes |
| Devices | Windows devices, Microsoft Entra joined, so sub settings can be scoped by user or computer group | Windows settings |
Configuration
One setting in the portal decides which prompt users see.
Setting up the UAC prompt is simple. Sign in to the ABR portal (adminbyrequest.com) and open Settings > Windows Settings (or Windows Sub Settings) > Endpoint:
On the UAC tab, choose how users confirm an elevation:
- Confirmation (new in 2020): more convenient, but less secure, because someone else could approve on an unlocked screen.
- Credentials (default in 2020): users type their credentials at every UAC prompt. Safer, but slower for users.
Update (October 2026): the setting is now called User Account Control Mode, with three choices: Confirm (default), Multi-factor Authentication and Authenticate (see ABR: Windows settings).
User Experience
Two devices, two different UAC prompts for the same user.
I had a standard user (testuser) and two Windows 10 devices, Microsoft Entra joined. The global Windows Settings used UAC credentials, and a Sub Settings profile used UAC confirmation. Each profile applied to a Microsoft Entra ID group of computers.
Note: sub settings can be scoped to users, computers or both.
The Authorization > Run As Administrator settings are the same for both devices:
When the user signs in to each device and starts an installer (here Wireshark) with Run as administrator, they see a different UAC prompt on each device:
UAC credentials (before version 7.0)
On Client1, testuser gets the credentials prompt and must type an email address and password, as in every ABR version before 7.0:
UAC confirmation (new in version 7.0)
On Client2, testuser only confirms with Yes or No, with no login details:
Note: if Require reason is on for Run As Administrator (under Authorization), the user sees one window to enter the reason and no further prompts.
This is a big simplification for users who need admin rights often in their daily work.