انتقل إلى المحتوى الرئيسي

DEV-118 - RBAC

Implementation Effort: Medium – Requires role design, assignment planning, and ongoing maintenance of custom roles.

User Impact: Low – Transparent to end users; primarily affects admin workflows and delegation.

Overview​

Role-Based Access Control (RBAC) in Microsoft Intune and Microsoft Entra enables granular delegation of administrative permissions. Rather than granting broad admin roles, RBAC allows organizations to define scoped roles that limit what actions administrators can perform and on which resources.

This supports Use least privilege access by ensuring each administrator only has the minimum permissions required for their responsibilities. It supports Assume breach by limiting the damage a compromised admin account can cause. Without proper RBAC, organizations often over-provision admin rights, creating unnecessary risk when accounts are compromised.

Key Configuration Steps​

  1. Audit existing admin role assignments and identify over-privileged accounts
  2. Define RBAC roles in Intune for helpdesk, app management, policy management, and reporting
  3. Create custom roles where built-in roles don't match organizational needs
  4. Assign scope tags to limit role visibility to specific device groups or locations
  5. Use Microsoft Entra administrative units for scoped directory role assignments
  6. Review and recertify role assignments on a regular cadence

Reference​