Key Takeaways
- Role-based access control (RBAC) in Microsoft Intune helps administrators control access to Windows Autopilot devices and management features based on assigned permissions.
- Custom Intune roles allow administrators to provide only the permissions required to manage Autopilot devices, profiles, and enrollment settings.
- Administrators can configure permissions such as Read device, Sync device, Create profile, Update profile, Assign profile, and Delete profile based on their requirements.
- The Windows Autopilot Operator custom role simplifies delegated device management while reducing the risk of unauthorized or accidental changes.
Let’s learn how you can Create a Custom Intune RBAC Role for Windows Autopilot Management. In this case, you will want to create a custom role that has the necessary permissions to manage Autopilot devices, such as the ability to reset, retire, or delete devices, as well as manage Autopilot profiles and settings. You may need to perform the cleanup in several scenarios when you need to use devices for testing or assign to the users depending on the situation, whether you are deleting the device from Azure Active Directory (Azure AD) or need to keep it for other purposes.
Table of Contents
Table of Contents
Create a Custom Intune RBAC Role for Windows Autopilot Management
Role-based access control (RBAC) helps Intune Admins to control who can perform various Intune tasks within your enterprise. There are twelve (12) built-in Intune roles (RBAC roles). You can create custom Intune roles if none of the provided roles supports your scenario. RBAC allows you to assign specific permissions to users or groups within Intune, controlling who can access and manage specific features and settings.
Without any additional configuration, it is possible to allocate built-in roles to groups. However, it is not feasible to modify the name, description, type, or permissions of a built-in role or remove it. The addition of Duplicate Intune RBAC Roles will also be helpful for Intune admin in terms of time savior and effort to create a role from scratch.
- Microsoft Intune Introduces Permission Level RBAC Visibility for Admins
- Assign Azure AD Roles Using Privileged Identity Management PIM
- New Built-in LAPs Client For Windows 11 And 10 | Conflict With Old Version Of LAPs
Configure Intune RBAC for Windows Autopilot Role
To create, edit, or assign roles, your account must have Global Administrator and Intune Service Administrator permissions in Azure AD. It is important to properly configure RBAC to ensure that only authorized users have access to critical management functions, reducing the risk of accidental or malicious misuse of Intune features.
- Sign in to the Microsoft Intune admin center.
- Navigate to Tenant administration > Roles > All roles.
- Click on Create and select Intune role from the appeared options.
Configure the Basic Details
On the Basics page, enter the name Windows Autopilot Operator in the Name field. In the Description field, enter “Manage Autopilot tasks, allow site admins/helpdesk to assign required roles.” Once you have entered the required details, click Next to proceed to the Permissions page.
Configure Permissions
On the Permissions page, you can find different permission categories for managing various tasks and features in Microsoft Intune, such as Android Enterprise, Android FOTA, and App Control for Business. Select the relevant permission categories and enable the required actions based on the responsibilities you want to assign to the Windows Autopilot Operator role.
Enrollment Programms
To modify the roles associated with a particular category, navigate to the “Permissions” page. When creating custom roles, you can enable the relevant permissions by selecting “Enrollment Programs” and toggling the switch to “Yes” to select the appropriate roles.
| Actions | Descriptions |
|---|---|
| Delete profile | Delete profiles for the Automated Device Enrollment, Apple School Manager, Apple Configurator, or Windows Autopilot. |
| Assign profile | Assign profiles for Automated Device Enrollment, Apple School Manager, Apple Business Manager, Apple Configurator, or Windows Autopilot. |
| Update profile | Manage profiles for the Automated Device Enrollment, Apple School Manager, Apple Configurator, or Windows Autopilot. |
| Create profile | Create new profiles for the Automated Device Enrollment, Apple School Manager, Apple Configurator, or Windows Autopilot. |
| Delete device | Delete Apple devices for the Automated Device Enrollment, Apple School Manager, or Apple Configurator. |
| Sync device | Initiate the Sync command for Windows Autopilot devices. |
| Read device | View Apple devices for the Automated Device Enrollment, Apple School Manager, Apple Configurator, or Windows Autopilot devices. |
| Read profile | View profiles for the Automated Device Enrollment, Apple School Manager, Apple Configurator, or Windows Autopilot. |
Configure Scope Tags
On the Scope tags page, select the required scope tags to determine which Intune resources the role can access. Scope tags help administrators limit access to resources based on their assigned administrative responsibilities.
Review and Create the Custom Role
On the Review + create page, review the configured details, including the role name, description, selected permissions, and scope tags. Ensure that the Windows Autopilot Operator role has the appropriate permissions and scope tags for the intended administrative tasks. Once you have verified all the settings, click Create to complete the custom role creation.
Upon successful role creation, a message with the “Windows Autopilot Operator” successfully created notification will automatically appear in the top-right corner.Click the Refresh button at the top to quickly see the roles. You will be able to see the Custom Intune role “Windows Autopilot Operator” created in the All Roles list.
Role Details through Properties
After creating the custom role, navigate to Tenant administration > Roles > All roles in the Microsoft Intune admin center and select the Windows Autopilot Operator role. Open the Properties page to review the role details, including its name, description, configured permissions, and scope tags. If you want, you can modify the permissions by navigating to the roles you created and clicking on Properties. Here you can also be able to get the details of permissions added for the role.
In Intune Portal, Navigate to Devices > Windows > Windows enrollment > Devices (under Windows Autopilot Deployment Program). Here you could perform multiple actions specific to the Windows Autopilot based on your assigned role.
The most common tasks you would like to allow are importing autopilot devices in a few scenarios only as the process is taken care of by OEM and read, deleting autopilot devices. The device deletion process was a bit challenging, Once the device is provisioned and associated with Intune, Azure AD Object. You need to first removed the associated Intune device then you will be able to delete the hardware hash. I have seen some weird behavior even if “Managed devices” delete permissions were assigned, ensuring the role is scoped in the correct group.
Once you have the appropriate access, you can manage or delete autopilot devices. Let’s review the steps to clean up your Intune Windows Autopilot devices more quickly, Delete Windows Autopilot Device From Intune.
Video Guide – Intune RBAC Strategic Options
In this video, you will get to know more about Intune RBAC Strategic options, Role Based Access Controls, Scope Groups and Intune Objects, and Roles.
Need Further Assistance or Have Technical Questions?
Join the LinkedIn Page and Telegram group to get the latest step-by-step guides and news updates. Join our Meetup Page to participate in User group meetings. Also, join the WhatsApp Community and the Whatsapp channel to get the latest news on Microsoft Technologies. We are there on Reddit as well.
Author
About Author – Jitesh, Microsoft MVP, has over six years of working experience in the IT Industry. He writes and shares his experiences related to Microsoft device management technologies and IT Infrastructure management. His primary focus is Windows 10/11 Deployment solution with Configuration Manager, Microsoft Deployment Toolkit (MDT), and Microsoft Intune.