Create custom role for Intune

Question

I have the following requirement:

We have 2 admin departments in our organization - Windows and Mobile for MDM.

We would like to setup custom roles or use scope tags such that:

1. Windows admin - They should be able to manage all aspects(Remote actions, create configuration, compliance policy, etc.) for only Windows devices.
2. Mobile admin - They should be able to manage all aspects(Remote actions, create configuration, compliance policy, etc.) for only Android and iOS/iPadOS devices.

Windows admin users should not be able to manage Android aspect of the settings and vice-versa.

Is this scenario possible to be created ?

Answer 1

@IntuneUser Thanks for posting in our Q&A.

Of course, you can. I have done the test in my lab. I will share you more details.

Step1: I create a device group that only includes windows devices.

Step2: I create a user group that I want the user in this group only can see windows devices.

Setp3: I create a scope tag called "windows scope tag" in Tenant administration > Roles > scope tags. In this "windows scope tag", I add the windows device group under "assignments".

Setp4: I create a custom role called "windows role" in Tenant administration > Roles and enable the feature what I want and add "windows scope tag".

Step5: I create a role assignment.

Stpe6： When I use the target user signing in intune portal, I can only manage windows devices and I can't see other platform devices.

Hope it will help.

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

@IntuneUser This is the double post.

Thanks for posting in our Q&A.

Of course, you can. I have done the test in my lab. I will share you more details.

Step1: I create a device group that only includes windows devices.

Step2: I create a user group that I want the user in this group only can see windows devices.

Setp3: I create a scope tag called "windows scope tag" in Tenant administration > Roles > scope tags. In this "windows scope tag", I add the windows device group under "assignments".

Setp4: I create a custom role called "windows role" in Tenant administration > Roles and enable the feature what I want and add "windows scope tag".

Step5: I create a role assignment.

Stpe6： When I use the target user signing in intune portal, I can only manage windows devices and I can't see other platform devices.

Hope it will help.

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.