Zum Hauptinhalt springen

DEV-121 - Scope Tags & Scoped Permissions

Implementation Effort: Medium – Requires defining a tagging taxonomy, applying tags to all relevant objects, and validating role assignments with the Permissions Assessment Report.

User Impact: Low – Transparent to end users; affects admin console visibility and policy management workflows.

Overview​

Scope Tags in Microsoft Intune control which Intune objects (policies, apps, profiles, elevation requests, and reports) an administrator can see and manage. While Scope Groups define which users and devices an admin can target, Scope Tags define which Intune objects are visible in their console.

With Scoped permissions (introduced in 2026 and moving to general availability as the tenant default), Intune no longer merges permissions across multiple role assignments that share the same permission category but use different scope tags. Each role assignment's permissions apply strictly within its own scope tag context. Furthermore, Endpoint Privilege Management (EPM) now enforces scope tags on both support-approved elevation requests and EPM reports, ensuring regional or delegated admins only view and approve elevation requests for devices within their assigned scope.

This supports Use least privilege access by ensuring administrators only see and modify the policies, configurations, and elevation requests relevant to their role. It supports Assume breach by preventing a compromised scoped admin from viewing or tampering with policies outside their designated boundary.

Key Configuration Steps​

  1. Define a scope tag taxonomy aligned to organizational delegation boundaries (e.g., region, business unit, platform).
  2. Run the Permissions Assessment Report (Tenant administration > Roles > Settings) to identify any admins whose effective permissions were previously merged across multiple role assignments, and enable Scoped permissions.
  3. Create scope tags in Intune for each administrative boundary.
  4. Apply scope tags to all relevant Intune objects: configuration profiles, compliance policies, apps, scripts, and EPM policies.
  5. Assign scope tags to RBAC role assignments alongside scope groups.
  6. Verify scoped administrators only see tagged objects and EPM elevation requests/reports within their assigned scope.

Reference​