Dave Randall

Intune · Microsoft Graph · Endpoint management

Practical Intune guidance, one post at a time.

The deep dives behind my LinkedIn series. Each daily post gets a page here with the diagram, the details that don't fit in a post, and links to go further. Written for Intune customers and the partners who run Intune for them.

Former Senior Microsoft Product Manager for Intune and Configuration Manager.

Start with RBACFollow on LinkedIn
Dave Randall

Series

Intune RBAC

20 Days of Intune RBAC

One Intune role-based access control concept every weekday for four weeks, with a diagram, for Intune customers and the partners who manage Intune for them. It starts with the basics and builds to the parts that trip up experienced admins.

Complete · 20 postsLatest: Day 20 →

Intune & Microsoft Graph

19 Days of Intune Graph

The Intune Fundamentals Guy, API Edition: a daily walk through automating Intune with Microsoft Graph, from your first call and OData basics to safe changes at scale, least-privilege automation, and reporting leaders actually use.

Complete · 19 postsLatest: Day 19 →

Latest

  1. 20 Days of Intune RBAC · Day 20Capstone: the reference architectureTwenty days in one picture. A reference architecture for Intune RBAC, from break-glass accounts to the Tier 1 help desk, with the day that covers each piece.
  2. 20 Days of Intune RBAC · Day 19Audit and automateA good RBAC design drifts unless you check it. Four built-in tools, Microsoft Graph, and a bonus PowerShell script tell you who has what, what changed, and which permissions nobody uses.
  3. 20 Days of Intune RBAC · Day 18RBAC keeps expandingIntune RBAC isn't finished. New permissions arrive, built-in roles change, and Intune roles now reach Copilot and automation. Your design needs a maintenance plan, not just a launch.
  4. 20 Days of Intune RBAC · Day 17Multi Admin ApprovalMulti Admin Approval makes a second admin approve your riskiest changes before Intune applies them, including changes to RBAC itself. Here's how it works, and the setup order that keeps you from locking yourself out.
  5. 20 Days of Intune RBAC · Day 16Just-in-time accessStanding admin access is access an attacker can use at any time. Privileged Identity Management turns it into access people request when they need it, and lose when they're done.