DEV-120 - Scope Groups

Implementation Effort: Medium – Requires group design, role assignment cleanup, and operational governance.

User Impact: Low – This mainly affects admin visibility and delegation, not user experience.

Overview

Scope groups in Microsoft Intune determine which users and devices an assigned administrator can manage. They are a core part of delegated administration because they let you limit operational reach by region, business unit, platform, or support tier. In Zero Trust, scope groups help contain the impact of an over-privileged or compromised admin by reducing the number of resources that account can affect.

Implementation Guidance

1. Design scope boundaries before creating groups. Common patterns include geography, subsidiary, support tier, lab versus production, and device ownership model.
2. Use Microsoft Entra security groups with clear naming and ownership. Avoid overlapping or ambiguous groups that make entitlement reviews hard.
3. Pair scope groups with Intune RBAC role assignments so help desk or engineering staff can manage only the intended user and device sets.
4. Document where dynamic membership makes sense and where manual membership is safer. The goal is predictable targeting, not maximum automation everywhere.
5. Pilot with representative admin accounts to confirm that operators can complete their jobs without seeing unrelated devices or users.
6. Review memberships and role assignments regularly, especially after reorganizations, mergers, or support model changes.

Reference

• Role-based access control (RBAC) with Microsoft Intune - Microsoft Intune — Introduces Intune RBAC roles, permissions, scope groups, and delegated administration.
• How to manage groups - Microsoft Entra — Explains how to create, manage, and maintain Microsoft Entra groups and membership.
• Use role-based access control (RBAC) and scope tags for distributed IT - Microsoft Intune — Explains how to use scope tags and RBAC to limit admin visibility and control in Intune.