跳到主要内容

005: Scope Groups

Implementation Effort: Medium – Requires planned group design and testing with delegated administrators.

User Impact: Low – This changes administrative boundaries rather than the end-user experience.

Overview​

Scope groups in Microsoft Intune define which users or devices a delegated administrator can manage. They are part of the RBAC assignment model and should be designed as operational boundaries, not as a duplicate of every deployment group in the tenant. In Zero Trust, scope groups limit blast radius by ensuring that a help desk admin in one region or service line cannot manage devices outside that approved boundary.

Implementation Guidance​

  1. Identify the real management boundaries first, such as region, subsidiary, classroom versus production, or frontline versus knowledge worker device populations.
  2. Create Microsoft Entra security groups for those boundaries and assign clear owners who can approve membership changes.
  3. Use Intune role assignments that combine members, scope groups, and scope tags so delegated admins can act only on the correct people and devices and see only the correct objects.
  4. Keep scope groups distinct from deployment groups unless the same boundary truly serves both purposes. Reusing every deployment group as an admin scope often creates unnecessary complexity.
  5. Validate the design with pilot admin accounts and task-based testing such as remote actions, policy assignment, and reporting visibility.
  6. Review the groups after reorganizations or support-model changes so delegated access remains accurate.

Reference​