Dave Randall

Topic

Intune RBAC

Role-based access control in Microsoft Intune, from built-in roles to scope tags, delegated admin for partners, and governance at scale.

20 Days of Intune RBAC

One Intune role-based access control concept every weekday for four weeks, with a diagram, for Intune customers and the partners who manage Intune for them. It starts with the basics and builds to the parts that trip up experienced admins.

5 of 20 published · #20DaysOfIntuneRBAC on LinkedIn

Week 1

Foundations

Who can do what

  1. 01How many of your admins have only the permissions they need?
  2. 02Two permission planes
  3. 03The built-in roles
  4. 04Role vs. assignment
  5. 05Anatomy of a permission
Week 2

Scoping

Where they can act

  1. 06Members vs. scope groupsComing Oct 19
  2. 07Scope tags explainedComing Oct 20
  3. 08Getting tags onto devicesComing Oct 21
  4. 09Scope groups vs. scope tagsComing Oct 22
  5. 10The Default tag gotchaComing Oct 23
Week 3

Design patterns

Building for real organizations

  1. 11Custom rolesComing Oct 26
  2. 12Persona-based designComing Oct 27
  3. 13Delegating by region or business unitComing Oct 28
  4. 14Multiple assignments and the merge problemComing Oct 29
  5. 15Partners and MSPsComing Oct 30
Week 4

Governance

Keeping it secure at scale

  1. 16Just-in-time accessComing Nov 2
  2. 17Multi Admin ApprovalComing Nov 3
  3. 18RBAC keeps expandingComing Nov 4
  4. 19Audit and automateComing Nov 5
  5. 20Capstone: the reference architectureComing Nov 6

Guides and references