Microsoft EPM – Random CMD / PowerShell / OpenConsole popups

Your setup has an Elevation Settings policy with User Confirmed enabled, yet consoles appear at sign-in and on a non-pilot device. An EPM-triggered launch is unproven: Microsoft documents User Confirmed elevation as starting through Run with elevated access, while assigning the settings policy installs the Microsoft EPM Agent service.

In Intune admin center, open Endpoint security > Endpoint Privilege Management > Reports > Elevation report. Filter by user, device, and popup time; it records file name, result, and timestamp, although processing can take 24 hours. On a test device, enable Audit Process Creation, reproduce the popup, and inspect Security event 4688 for the new process and creator process. Compare an EPM-only device, an Admin By Request-only device, and a coexistence device. If no matching EPM elevation exists, investigate its parent process. Microsoft does not document a compatibility conclusion for Admin By Request, VS Code, WSL, or OpenConsole from these symptoms.