Introduction

This post is the part 2 of my initial writing on RBAC in Intune.
My intention is to explain a real world example on RBAC design with Intune and Azure AD, since device operations can be made on the Intune device object, but also on the Azure AD device object. From both sides you can perform different tasks and therefore need different roles. Simpliy put, with RBAC you can control who can do what.

Role Based Access Control

RBAC areas

Scope tags

Scope tags is an Intune feature that allows to set a tag (essentially an attribute) on any content in Intune such as devices, profiles, apps and more. The whole idea behind it is, that admins can only manage resources assigned with a specific tag. Common real world examples are:

• Remote IT admin only needs to view and manage devices in his location
• An IT admin only needs to view and configure a subset of profiles and apps

There is already a great blog post on scope tags from my colleague Nicola Suter, if you are more interested in this topic.

Administrative Units

Administrative Units are a virtual container inside of Azure AD. You can either add users or devices to an Administrative Unit. Azure AD roles can then be assigned on the scope of that Unit, but not the whole directory. This allows IT admins to only manage a subset of all users and devices.

Restricted Management Administrative Units

There is a new feature called Restricted Management Administrative Units (RMAU). These are just like Administrative Units, but require allow for explicit management. An administrator must be assigned a privileged role on the RMAU to manage the identities which are member of the RMAU (users/devices). Tenant roles do not apply for any identity within the RMAU. (Except for Global Admin and Privileged Role Administrator).

Design

Combining these two features, the whole setup could be designed accordingly. This setup would allow you to have a single admin group which can manage device aspects from Intune and Azure AD.

Prerequisites

To setup this, follow the steps below. Please make sure you have the following prerequisites:

Azure AD security group for IT admins
Create a security group with assigned membership, where admins can be added.

Azure AD security group for devices

Create a security group with dynamic device membership, this will automatically add devices based on a query to this group.

Next you want to edit the dynamic query. I have highlighted in yellow the properties which could be helpful. From my experience you could use:

• enrollmentProfileName, according to the profile name which was used in Intune
• devicePhysicalIds, possible to work with GroupTags
• deviceModel, often hardware vendors (such as Lenovo) have different Model identifiers according to the keyboard layout, this could be the simplest way to identify devices in multiple locations

Azure AD setup

1. Let's start with the Administrative Unit which you can create from Azure

2. Name the Unit and create it
3. Under Properties you can switch the membership to dynamic device and add the same query as from the device group created previously

4. Assign the desired role (for device related actions choose the Cloud Device Admin)

Intune setup

Let's go through the Intune setup of scope tags, roles and assignments.

Create new scope tag

1. Go to Tenant administration>Roles>Scope Tags and add a new tag

2. Name the tag

3. Assign the devices group that we created previously. This will add this scope tag to all devices which are member of that group.

Assign role to scope tag

1. Go to Tenant administration>roles, here you can see all built-in Intune roles. Custom roles are also supported. Learn more

2. Choose one of the roles and add an assignment

3. Name the assignment

4. Add the admin group that we created previously

5. You could even filter more for groups. I recommend to add all devices.

6. Select the scope tag that we created before

Finished 🥳 With this configuration from Azure AD and Intune:

• All members of the "IT admins" group can only view BitLocker keys and LAPS passwords for the devices added to the "IT devices" group
• All members of the "IT admins" group can only perform remote actions for the devices added to the "IT devices" group
• Admins which have a role assigned at the tenant-level can manage all devices. (Except if a device is added to a RMAU)

Endpoint Management with Microsoft Intune

Ever wanted a full tutorial how to deal with Microsoft Autopilot Intune Technology? Well here it is!

OceanleafNiklas Tinner