跳到主要内容

DEV-118 - RBAC

Implementation Effort: Medium – Requires role design, assignment planning, and ongoing maintenance of custom roles.

User Impact: Low – Transparent to end users; primarily affects admin workflows and delegation.

Overview​

Role-Based Access Control (RBAC) in Microsoft Intune and Microsoft Entra enables granular delegation of administrative permissions. Rather than granting broad admin roles, RBAC allows organizations to define scoped roles that limit what actions administrators can perform and on which resources.

In 2026, Microsoft Intune introduced Scoped permissions for RBAC (moving from public preview to the default behavior for all tenants). Previously, when an admin had multiple role assignments using different scope tags for the same permission category, Intune merged permissions across those assignments, which could unintentionally grant broader access than intended. With Scoped permissions enabled, each role assignment's permissions apply strictly within its own scope tag context. Admins can run the Permissions Assessment Report (Tenant administration > Roles > Settings) before opting in to preview how role permissions will change.

Additionally:

  • Security Copilot in Intune role inheritance: When Intune is enabled as a data source in Security Copilot, the Microsoft Entra Intune Administrator role automatically inherits Security Copilot owner access, and all other built-in and custom Intune RBAC roles automatically inherit Security Copilot contributor access without requiring separate Security Copilot role assignments.
  • Dedicated Zero-Touch Enrollment RBAC permission: Intune provides a dedicated RBAC permission for Google zero-touch enrollment portal access, separating it from the broader Update app sync permission.

This supports Use least privilege access by ensuring each administrator only has the minimum permissions required for their responsibilities within their exact scope tag boundary. It supports Assume breach by limiting the blast radius a compromised admin account can cause.

Key Configuration Steps​

  1. Audit existing admin role assignments and identify over-privileged accounts.
  2. Run the Permissions Assessment Report under Tenant administration > Roles > Settings and enable Scoped permissions so role assignments do not merge across scope tags.
  3. Define RBAC roles in Intune for helpdesk, app management, policy management, zero-touch enrollment, and reporting.
  4. Create custom roles where built-in roles don't match organizational needs.
  5. Assign scope tags to limit role visibility to specific device groups or locations.
  6. Use Microsoft Entra administrative units for scoped directory role assignments and review assignments regularly.

Reference​