Duplicating an Intune role preselects all permissions and scope tags from the original. The duplicate’s name, description, permissions, and tags can then be changed. Microsoft requires a unique name. Where Multi Admin Approval protects RBAC changes, a second administrator’s approval is required before the protected change takes effect. Microsoft Learn.
\nUse this review when a current role is a starting point for a different job function. Define the new operator’s permitted tasks and intended resource scope before copying the role.
\nPrepare a comparison that separates permissions to keep, remove, and add. Review copied tags independently from action permissions; a familiar role name is not a sufficient description of its contents. Give the duplicate a purpose-specific description and have the service owner justify any destructive or assignment-related capability. Keep the original role unchanged unless a separate approved request covers it.
\nCompare the saved duplicate with the approved permission-and-tag list before assigning it to a pilot operator. Rehearse required tasks and selected prohibited tasks on nonproduction resources with that account. Examine its other assignments when interpreting the outcome, and document any unexpected capability for investigation. Retain the source role identity, reviewed differences, and actual pilot results so future administrators can understand why the clone exists rather than assuming it is an interchangeable copy.
\n