In a huge enterprise scale deployments there will be various teams who handles the services with multiple administrator accounts.These executives must be furnished with administrator accounts which are appropriate to their boundaries.Microsoft intune being a device,apps and office 365 administration management there are high prospects that this element may be used over various departments,applications,devices and from various areas. Microsoft Intune having lots of features and capabilities now most of the organizations are moving as managed tenant with Microsoft intune.

For instance there can be multiple app protection policies, device compliance policies, app configuration policies ,etc., are created for multiple services one for meeting room management, another for BYOD devices and for corporate windows devices. In these situations we need to create customized role based access control for each users.

With the default intune admin role assignments, we cannot manage to provide custom permissions and hence need to take little bit different approach in order to deploy in a decentralized environment.

We shall consider a scenario where there are 2 different cases of leveraging Microsoft Intune as a managment authority one for Meeting rooms and another one for managing office 365 and Line of business apps in BYOD devices.

Ideally in this scenario we must be having two sets of policies ,intune services with different role sets and visibility of policies to the administrators.

Below policies for BYOD devices were created –

App Protection Policies

• 

App Configuration Policies

• 

Compliance Policies

• 

Below Policies for Meeting rooms were created –

App Protection Policies

• 

App Configuration Policies

• 

Compliance Policies

• 

Having the policies created now we need to segregate them by tagging to associated admin groups, device groups and scope tags.

Created Admin Groups –

Group 1: MRM Admins – To manage only the Meeting room  intune policies.

Group 2: Pilot Mobile Admins – To manage only the Andriod/IOS Intune  device policies.

Created Device Groups –

Group 1: Meeting Rooms – Created to add the meeting room devices and service accounts. This is required to scope this group in the custom RBAC role that we are creating and targeting for meeting room systems and their service accounts.

Group 2: IntuneMobileDevices – Created to add the BYOD users accounts . This is required to scope this group in the custom RBAC role that we are creating and targeting for byod users.

Created Scope Tags –

Scope Tag 1: Mobile-Admin – To tag all the BYOD mobile IOS/Andriod policies, users and devices. We have added the created group for intune users. One important point to note here is that all new users who needs to be part of intune policies needs to be added to this group.

• 

The policies can be tagged to their related scope tags from the properties page.

• 

Scope Tag 2: SRS-Admin – To tag all the meeting room devices and the service accounts.

• 

In the same way we did for BYOD devices meeting room policies were tagged to this scope tag.

• 

Scope tags are very much required and they are the basic benchmarks which are used to segregate the roles, permissions, devices and users. In this case we have created two scope tags and associated them to their corresponding policies,users,devices and admins.

Created 2 Custom RBAC roles –

Role 1: Meeting Room Admin – Clone copy of policy and profile manager role scoped only to MRM admins group. Tagged this role to SRS-Admin scope tag.

Role 2: Mobile Administrators – Clone copy of policy and profile manager role scoped only to Pilot Mobile Admins  admins group. Tagged this role to Mobile-Admin Scope tag.

The default RBAC roles will provide visibility to all the policies and hence we need to create new roles.Here we have created two clones of the default policy (policy and profile manager). Tagging these two roles to the appropriate scope tags is very important. Ideally scope tags are the components which seperates the role segregation based on policies and users defined on them.

Finally created few policies and tagged them separately for Mobile devices and meeting rooms.

Admin log in experience:

Policies  visibility from Global Admin account where we could see all the policies in the intune portal.

• 

When logging in from mobile admin we see only mobile device policies for byod associated with him.

• 

Only BYOD device compliance policies are present.

• 

In the same way when logging from SRS admin we see only the meeting room policies associated with him.

• 

Only meeting room app protection policies are found.

• 

Caveats :

1. For custom RBAC role it is requesting an EMS license to be assigned mandatorily for the admin accounts. I attempted the admin accounts without the licenses and it is not working.
2. Once the policy is applied to admin accounts it is taking almost 24 hours’ time to be in effect.

We can utilize role based access control in combination with scope tags to ensure that the privilege administrator accounts have the correct access and perceivability to the right Intune objects. Scope tags figure out which objects administrators can see from their admin portal.

Thanks & Regards

Sathish Veerapandian