Week 3: Who holds the keys

Two layers of roles

Microsoft Entra roles work tenant-wide: Global Administrator, Intune Administrator (full control of Intune), Cloud Device Administrator (devices in Entra) and Windows 365 Administrator. Intune RBAC roles live inside Intune and can be scoped: Policy and Profile Manager, Help Desk Operator, Read Only Operator, Application Manager, Endpoint Security Manager and Intune Role Administrator.

Dev: Entra roles are master keys. Intune roles are keys cut for one door.

What a role assignment contains

A built-in or custom Intune role does nothing until you assign it. The assignment says who (an admin group), what (the role's permissions), which users and devices they may act on (scope groups) and which objects they may see (scope tags). Only the Intune Role Administrator can assign Intune roles to other admins (besides the Entra admin roles above).

Assignment: Store help desk
 Role      Help Desk Operator
 Members   KC-Adm-StoreHelpdesk
 Scope     KC-Usr-Store-Staff
 Tags      Stores

Exam tip Read the stem for the verb: "view only" = Read Only Operator, "remote tasks on devices" = Help Desk Operator, "apps" = Application Manager.

Custom roles and Windows 365

When no built-in role fits, create a custom role (or duplicate a built-in one) and tick exactly the permissions needed. Example: Rotate Local Admin Password isn't in any built-in role. For Cloud PCs, Intune adds Cloud PC Administrator and Cloud PC Reader roles, and Entra has Windows 365 Administrator.

Exam tip Least privilege on the exam: prefer a scoped Intune role or a custom role over Intune Administrator or Global Administrator.

Scope tags

A scope tag is a label on Intune objects: policies, apps, profiles, devices. An admin sees and edits only objects whose tags match the tags on their role assignment. Everything starts with the Default tag. Tag devices by assigning the scope tag to a device group. Objects tagged Stores stay invisible to an admin scoped to Warehouse.

Scope tag   Assigned device group
Stores      KC-Dev-Store-All
Warehouse   KC-Dev-WH-All

Store tech role tags: Stores
=> sees store POS PCs and store policies

Exam tip Scope groups decide whom you can act on. Scope tags decide what you can see. Distributed IT often needs both.

Multi admin approval

Multi admin approval uses access policies so a second admin must approve sensitive changes. Protectable areas include app deployments, compliance policies, settings catalog policies, scripts, RBAC changes, and the wipe, retire and delete device actions. The requester submits with a justification. An approver from the policy's approver group approves, then the requester selects Complete.

Exam tip Nobody approves their own request, not even a Global Administrator. The approver group must be a security group assigned to an Intune role.

Windows Hello for Business

Windows Hello for Business replaces passwords with a PIN or biometric unlocking a key stored in the device's TPM. A stolen PIN is useless without that exact device. Set it tenant-wide under Devices > Enrollment > Windows > Windows Hello for Business (it applies as devices enroll), or target groups with an account protection policy or the settings catalog.

Exam tip For hybrid users who need on-premises resources, cloud Kerberos trust is the simplest Windows Hello for Business trust model.

Windows LAPS with Intune and Entra

Windows LAPS gives each device its own local admin password, rotates it on a schedule, and backs it up to Microsoft Entra ID (or on-premises AD). Turn on Enable Local Administrator Password Solution (LAPS) in Entra Device settings. Then create Endpoint security > Account protection > Local admin password solution (Windows LAPS) with the backup directory, password age and complexity.

Exam tip LAPS manages one local admin account per device. Without an account name, it manages the built-in Administrator.

Reading and rotating the password

To view a password (device > Local admin password), you need an Entra permission to read device local credentials, for example the Cloud Device Administrator role. To rotate it on demand, use the Rotate local admin password device action. Its permission isn't in any built-in role, so build a custom Intune role. Rotation fails on a device that never backed up its password.

Device KC-LT-0142 > Local admin password
Account name      kcadmin
Password          ************  [Show]
Last rotation     10/12 06:00
Next rotation     11/11 06:00

Managing local group membership

Endpoint security > Account protection > Local user group membership controls built-in local groups such as Administrators. Add (Update) adds members and leaves others alone. Remove (Update) removes the listed members. Add (Replace) makes the group exactly your list and removes everyone else, like a Restricted Group.

Exam tip "Only these accounts may be local admins, remove all others" = Add (Replace). If Replace and Update both target a group, Replace wins.

RBAC answers two questions

Intune role-based access control (RBAC) answers what can this admin do (the role: a set of permissions such as Help Desk Operator or a custom role) and on which things (the scope). A role assignment ties a role to members (an admin security group), a scope (groups) of users/devices they can manage, and scope tags.

Exam tip Built-in roles can't be edited; copy one into a custom role to change permissions.

What a scope tag does

A scope tag is a label you put on objects (policies, apps, devices, scripts, enrollment profiles). An admin whose role assignment includes tag Detroit sees and edits only objects tagged Detroit. Objects with no tag get the Default tag. Devices pick up tags through their membership in a tagged group or via enrollment profile.

• Create tags: Tenant administration > Roles > Scope (Tags)
• Add the tag to the role assignment (Roles > role > Assignments)
• Tag the objects: each policy/app has a Scope tags section
• Tag devices by assigning the tag to a device group

Exam pattern

Multi-site or multi-team company where each IT team must manage only its own devices and policies: use scope tags + role assignments, not separate tenants. If an admin can't see a policy another admin made, check the policy's scope tags against the admin's assignment.

Exam tip Scope (groups) limits who/what an admin can target; scope tags limit which objects they can see. You usually need both.

Why it exists

Multi Admin Approval (MAA) stops one compromised or careless account from making a big change alone. You create an access policy that protects one kind of change; after that, a change of that kind becomes a request that a different admin must approve before it takes effect.

• Apps (app deployments, not app protection policies)
• Scripts (Windows scripts deployed to devices)
• Device actions: wipe, retire, delete
• Compliance policies and configuration (settings catalog) policies
• Role-based access control changes
• Tenant configuration such as device categories

How the workflow runs

1. An admin creates an access policy in Tenant administration > Multi Admin Approval, choosing the profile type, an approver group (a security group) and a justification. A second admin approves it, then the creator selects Complete. 2. From then on, a protected change asks for a business justification on Save. 3. An approver opens Received requests and selects Approve or Reject. 4. The requester returns and selects Complete to apply it.

• Statuses: Needs approval, Approved, Completed, Rejected, Canceled, Expired
• An approved request not completed within 3 days expires
• Approvers can't approve their own requests
• Intune doesn't email anyone about requests: approvers have to check

Exam traps

Approval alone doesn't apply the change: the requester completes it. Changes to access policies themselves always need a second admin. Protecting role changes before your RBAC assignments are in place can lock you out (a deadlock), so set up RBAC first.

Exam tip If a wipe 'didn't happen' in a tenant with MAA, the likely cause is a pending, rejected or expired request.