DEV-120 - Scope Groups

Implementation Effort: Medium – Requires planning of group structure aligned to organizational boundaries and ongoing group membership management.

User Impact: Low – Transparent to end users; affects how administrators target policies and manage devices.

Overview

Scope Groups in Microsoft Intune define which sets of users and devices an administrator can see and manage. By assigning scope groups to RBAC role assignments, organizations limit each admin's visibility to only the devices, users, and policies relevant to their responsibilities.

This supports Use least privilege access by ensuring administrators only interact with resources within their designated scope. It supports Assume breach by containing the blast radius of a compromised admin account to a specific subset of devices and users rather than the entire tenant.

Key Configuration Steps

1. Identify organizational boundaries for admin delegation (geography, department, device type)
2. Create Microsoft Entra security groups that represent each scope boundary
3. Populate scope groups with appropriate device and user memberships
4. Assign scope groups to Intune RBAC role assignments to limit admin visibility
5. Test that scoped administrators can only see and manage their assigned resources
6. Establish a process for reviewing and updating scope group memberships

Reference

• Role-based access control in Intune
• Use RBAC and scope tags for distributed IT