Intune RBAC & Windows Hello for Business

Who can do what in Intune?

Built-in Intune roles

Chen Wei at Meridian Bank has a team of 15 IT staff. He doesn’t want every team member to have the power to wipe 10,000 devices. Here are the built-in roles he uses:

Role	What They Can Do	Who Gets It
Intune Administrator	Everything in Intune	Chen Wei (IT Security Lead) only
Helpdesk Operator	View device/user info, perform remote actions (lock, sync, restart), reset passcodes	Helpdesk team (5 staff)
Application Manager	Manage apps: add, assign, update, delete. Can’t touch device policies.	App deployment team (2 staff)
Endpoint Security Manager	Manage security baselines, compliance policies, conditional access integration	Security team (3 staff)
Read Only Operator	View everything, change nothing	Auditors, junior staff
Policy and Profile Manager	Create and manage config profiles and compliance policies	Device config team (2 staff)
School Administrator	Manage devices and apps for education tenants	Not used at Meridian

Custom roles

If built-in roles don’t fit, you can create custom roles:

1. Intune admin center → Tenant administration → Roles → Create role
2. Pick a name and description
3. Select specific permissions (e.g., “Remote tasks: wipe = Yes, Remote tasks: retire = No”)
4. Assign the role to a group with a scope group (limits which devices they manage)

💡 Exam tip: scope tags and scope groups

RBAC in Intune has two scope concepts — don’t confuse them:

• Scope groups = which users/devices the admin can manage (e.g., “only devices in the Finance department”)
• Scope tags = which Intune objects (policies, profiles, apps) the admin can see (e.g., “only policies tagged ‘Finance’”)

Together, they create fine-grained access: an admin might only manage Finance department devices AND only see Finance-tagged policies. This is especially useful in large orgs like Meridian Bank where different teams manage different business units.

Windows 365 roles: separate the job from the scope

Cloud PC administration also uses role assignments in the Intune admin center. Cloud PC Administrator can manage provisioning, images, and Azure network connections; Cloud PC Reader can inspect Cloud PC information without changing it. The Microsoft Entra Windows 365 Administrator role is a separate directory role, not another name for an Intune custom role.

Suppose the regional helpdesk only needs to view Cloud PC status. Start with Cloud PC Reader, not Global Administrator. If staff need a smaller set of write operations, create an Intune custom role with the required Cloud PCs permissions, assign an administrator group, and configure the applicable scope. Test with a member of that group against an in-scope and an out-of-scope device. A role’s name alone does not prove the assignment is correctly scoped.

See Windows 365 role-based access for the permission list and assignment model.

Multi-admin approval: permission is not approval

RBAC answers who may request a change. Multi-admin approval (MAA) adds a second check: a different administrator must approve a change to a resource protected by an access policy before Intune applies it.

1. In Tenant administration > Multi Admin Approval, create an access policy for a supported resource type, such as Windows scripts.
2. Select an approver group whose members can review that type of change.
3. The first administrator submits a protected change with a justification. The request remains pending rather than immediately changing devices.
4. A different authorised approver reviews and approves or rejects it. Check the request status and audit trail before assuming the change is active.

Do not solve a pending-approval problem by granting broader roles. The requester cannot approve their own request; being allowed to edit a resource does not bypass the access policy. Protection applies to the configured resource types, not automatically to every tenant setting.

Knowledge Check

A Finance-scoped administrator can edit a protected Windows script, but the saved change has not reached devices. The request shows Pending approval. What should happen next?

AGive the requester Global Administrator so the save takes effectBAsk a different authorised approver to review the pending changeCRemove the Finance scope tag from every policyDWipe the affected devices to force the new script

Check Answer

Source: Use multi-admin approval in Intune.

Windows Hello for Business

What is it?

Hello for Business vs regular Windows Hello

Feature	Windows Hello	Windows Hello for Business
Purpose	Consumer convenience	Enterprise security
Key storage	Software-based	TPM-backed (hardware)
Managed by	User	IT admin via Intune or GPO
Credential type	Local PIN/biometric	Asymmetric key pair + PIN/biometric
Phishing resistant	Basic	Yes — private key never transmitted
Multi-factor	No	Yes — device possession + biometric/PIN

Configuring Hello for Business with Intune

Chen Wei enables Hello for Business across all Meridian Bank devices:

1. Intune admin center → Devices → Enrollment → Windows Hello for Business

2. Configure the tenant-wide settings:

   • Enable: Yes
   • Minimum PIN length: 6 (Chen Wei sets 8 for banking compliance)
   • Maximum PIN length: 127
   • Lowercase letters in PIN: Required
   • Uppercase letters in PIN: Required
   • Special characters in PIN: Allowed
   • PIN expiration: Not configured (Microsoft recommends against PIN expiration)
   • Use biometrics: Yes
   • Use TPM: Required
   • Allow phone sign-in: No (Chen Wei blocks this for security)

3. Alternatively, create a device configuration profile or identity protection policy for group-specific settings

ℹ️ Deep dive: Hello for Business deployment models

There are several deployment models, and the exam may test awareness of them:

• Cloud-only — simplest. Entra ID + Intune. No on-prem infrastructure. Best for cloud-native orgs like CloudForge.
• Hybrid key trust — uses Entra ID + on-prem AD + Entra Connect. The on-prem DC validates the key. Common during migration.
• Hybrid certificate trust — adds PKI (certificate authority). The on-prem DC validates a certificate. More complex, needed for RDP scenarios.
• On-premises key trust — purely on-prem AD with Windows Server 2016+. No cloud dependency.

For the exam, focus on: cloud-only is simplest, hybrid key trust is most common during migration, all models require TPM 1.2 or later.

🎬 Video walkthrough

Flashcards

Question

What's the difference between scope tags and scope groups in Intune RBAC?

Click or press Enter to reveal answer

Answer

Scope groups control WHICH devices/users an admin can manage. Scope tags control WHICH Intune objects (policies, profiles, apps) an admin can see. Together, they limit both the targets and the tools an admin can access.

Click to flip back

Show hint

Question

What makes Windows Hello for Business resistant to phishing?

Click or press Enter to reveal answer

Answer

It uses asymmetric key pairs where the private key is stored in the device's TPM and never transmitted during authentication. Even if an attacker intercepts the authentication flow, they can't replay or steal the credential.

Click to flip back

Show hint

Question

Which built-in Intune role should you assign to helpdesk staff?

Click or press Enter to reveal answer

Answer

Helpdesk Operator — it allows viewing device/user information and performing remote actions (lock, sync, restart, passcode reset) without the ability to modify policies, profiles, or app assignments.

Click to flip back

Question

Does Microsoft recommend setting PIN expiration for Windows Hello for Business?

Click or press Enter to reveal answer

Answer

No. Microsoft recommends against PIN expiration. Since the PIN is hardware-backed (TPM) and only works on the specific device, it doesn't have the same risks as traditional passwords. Forcing rotation provides minimal security benefit.

Click to flip back

Knowledge Check

Knowledge Check

Chen Wei has a helpdesk team of 5 staff who need to view device information and perform remote actions like lock and restart — but must NOT be able to create or modify policies. Which approach follows the principle of least privilege?

AAssign the Global Administrator role — it includes everything they needBAssign the Intune Administrator role and verbally instruct them not to change policiesCAssign the built-in Helpdesk Operator roleDCreate individual Entra ID accounts with no roles — helpdesk staff don't need Intune access

Check Answer

Knowledge Check

Aroha at CloudForge is deploying Windows Hello for Business to her 30-person startup. All devices are cloud-native (Entra Joined, no on-prem AD). Which deployment model should she use?

AHybrid key trust — the most common modelBHybrid certificate trust — for maximum securityCCloud-only — simplest, no on-prem infrastructure neededDOn-premises key trust — most reliable for small organisations

Check Answer

---

Next up: Compliance Policies & Conditional Access — defining what “compliant” means and blocking non-compliant devices from accessing resources.