# Elevation Analytics

> Audit elevation activity across your fleet: how often users request elevated access, for which applications, and whether requests were approved.

Source: https://docs.capaone.com/capaone/privilege-manager/elevation-analytics/  
Product: CapaOne — a separate CapaSystems product; do not apply this page to any other.

The **Privileges page** (Windows → Privileges) gives you a continuous audit trail of elevation
activity across your fleet. Use it to understand how often users request elevated access, which
applications are being elevated, and whether those requests are being approved or rejected — all
without touching individual endpoints.

## Time range

All views share a single time range selector at the top: **Today**, **3D** (3 days), **7D**,
**1M**, and **3M**. The elevation count badge next to the selector shows the total number of
elevation events in the selected period at a glance.

Changing the time range updates every chart simultaneously, so you can quickly compare a single
day against the past month.

## Summary

The Summary tab is the starting point — it answers the question "how much elevation activity is
happening?"

Four count cards show the totals for the selected period:

- **Installed Applications** — software installed through a privilege elevation
- **Removed Applications** — software removed through a privilege elevation
- **Elevated Applications** — the number of distinct applications that were elevated
- **Elevated User Accounts** — the number of distinct users who requested elevation

If these numbers are unexpectedly high, or growing over time, that is a signal to review whether
your elevation policies are scoped correctly.

## Applications tab

The Applications tab shows install and remove events that happened via elevation. It is useful
for answering "what software is being installed or removed by users who needed elevated rights?"

If you see unexpected applications being installed through elevation, check whether those
applications should be deployed centrally through [Application Manager](/capaone/application-manager/)
instead of relying on individual user elevation requests.

## Process Elevation tab

Process elevation is the more granular of the two elevation types — a user runs a single
executable with admin rights rather than gaining a full admin session. This tab answers "which
applications are being elevated, by whom, and are those requests being allowed?"

The **Elevated Applications** chart shows which executables are elevated most frequently. High
counts for unexpected applications may indicate users working around policy restrictions.

The **Elevated User Accounts** chart breaks down elevation requests per user into **Approved** and
**Rejected**. A user with many rejected elevations is repeatedly trying to run something that
policy does not allow — that is worth investigating. A user with consistently approved elevations
for the same application is a candidate for a dedicated process elevation rule so they do not need
to request it manually each time.

## Session Elevation tab

Session elevation gives a user temporary administrator rights for their entire session, not just
a single process. It is broader and less restrictive than process elevation.

The **Elevated User Accounts** chart here shows the same Approved/Rejected breakdown, but scoped
to session elevation requests. Because session elevation is more powerful, rejected session
elevation requests deserve closer attention than rejected process elevation requests.

## Good to know

- **Process vs. Session elevation** — Process elevation is scoped to a single executable and is
  the preferred approach for most use cases. Session elevation is broader and should be granted
  only where process elevation is not practical. Both types are configured under
  [Windows → Configurations → Privileges](/capaone/privilege-manager/).
- **Rejected elevations are not failures** — they are the policy working correctly. But a pattern
  of repeated rejections for the same user or application suggests the policy may need adjustment.
- **Empty charts are expected** in environments with low elevation activity or strict process
  elevation rules that prevent most requests from reaching the approval stage.
- **Elevation analytics complement configuration** — use these charts to validate that your
  elevation configuration is behaving as intended, then tune the rules based on what you observe.