DEV-121 - Scope Tags

Implementation Effort: Medium – Requires defining a tagging taxonomy, applying tags to all relevant objects, and maintaining consistency as new policies are created.

User Impact: Low – Transparent to end users; affects admin console visibility and policy management workflows.

Overview

Scope Tags in Microsoft Intune control which Intune objects (policies, apps, profiles, and configurations) an administrator can see and manage. While Scope Groups define which users and devices an admin can target, Scope Tags define which Intune objects are visible in their console.

This supports Use least privilege access by ensuring administrators only see and modify the policies and configurations relevant to their role. It supports Assume breach by preventing a compromised scoped admin from viewing or tampering with policies outside their designated area, limiting lateral movement within the management plane.

Key Configuration Steps

1. Define a scope tag taxonomy aligned to organizational delegation boundaries
2. Create scope tags in Intune for each administrative boundary (e.g., region, department, device platform)
3. Apply scope tags to all relevant Intune objects: configuration profiles, compliance policies, apps, and scripts
4. Assign scope tags to RBAC role assignments alongside scope groups
5. Verify scoped administrators only see tagged objects in their Intune console
6. Establish governance to ensure new policies are tagged appropriately at creation

Reference

• Use RBAC and scope tags for distributed IT
• Create a scope tag