{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-100-protect-shared-intune-policies-when-delegating-local-policy-creation/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-100-protect-shared-intune-policies-when-delegating-local-policy-creation/", "slug": "dse-20260917-100-protect-shared-intune-policies-when-delegating-local-policy-creation", "url": "https://update.dsesecurity.com/updates/dse-20260917-100-protect-shared-intune-policies-when-delegating-local-policy-creation/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-100-protect-shared-intune-policies-when-delegating-local-policy-creation.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-100-protect-shared-intune-policies-when-delegating-local-policy-creation/" }, "title": "Protect shared Intune policies when delegating local policy creation", "summary": "How can a distributed Intune team keep local create permissions from reaching centrally shared policies?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:20+00:00", "modified_at": "2026-09-17T16:38:46+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 201, "potentially_affected": "Use this review when local Intune administrators need to create their own objects while assigning common centrally managed policies or applications. List the shared objects and the local responsibilities before changing role assignments.", "dse_recommendation": "DSE recommends reviewing the combined role assignments of each pilot administrator against a written shared-object boundary.", "primary_source": { "name": "Distributed IT with multiple admins - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/fundamentals/scale-guidelines", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft advises giving local administrators read and assign permissions when they do not need to create, update or delete an object. For mixed local and shared management, its design places common objects on a special group outside local administrators’ RBAC scope groups. That separation prevents the local create, update and delete permissions from applying to the common objects. Microsoft Learn.

\n

Applicability

\n

Use this review when local Intune administrators need to create their own objects while assigning common centrally managed policies or applications. List the shared objects and the local responsibilities before changing role assignments.

\n

DSE recommendation

\n

DSE recommends reviewing the combined role assignments of each pilot administrator against a written shared-object boundary. Identify which team owns changes to common policy and how local administrators request an exception. Keep the special group and its purpose visible in the delegation documentation.

\n

Verification

\n

With an approved pilot account, demonstrate permitted local creation and shared-object assignment, then attempt a prohibited shared-object edit in a safe test. Investigate any unexpected capability across all role assignments. Retain the actual allowed and denied outcomes before expanding delegation.

\n

Official references

\n

Microsoft Learn: Distributed IT environment with many admins in the same Microsoft Intune tenant. Source reviewed September 17, 2026.

", "content_text": "Source facts\nMicrosoft advises giving local administrators read and assign permissions when they do not need to create, update or delete an object. For mixed local and shared management, its design places common objects on a special group outside local administrators’ RBAC scope groups. That separation prevents the local create, update and delete permissions from applying to the common objects. Microsoft Learn.\nApplicability\nUse this review when local Intune administrators need to create their own objects while assigning common centrally managed policies or applications. List the shared objects and the local responsibilities before changing role assignments.\nDSE recommendation\nDSE recommends reviewing the combined role assignments of each pilot administrator against a written shared-object boundary. Identify which team owns changes to common policy and how local administrators request an exception. Keep the special group and its purpose visible in the delegation documentation.\nVerification\nWith an approved pilot account, demonstrate permitted local creation and shared-object assignment, then attempt a prohibited shared-object edit in a safe test. Investigate any unexpected capability across all role assignments. Retain the actual allowed and denied outcomes before expanding delegation.\nOfficial references\nMicrosoft Learn: Distributed IT environment with many admins in the same Microsoft Intune tenant. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nMicrosoft advises giving local administrators read and assign permissions when they do not need to create, update or delete an object. For mixed local and shared management, its design places common objects on a special group outside local administrators’ RBAC scope groups. That separation prevents the local create, update and delete permissions from applying to the common objects. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/fundamentals/scale-guidelines).\n\n## Applicability\n\nUse this review when local Intune administrators need to create their own objects while assigning common centrally managed policies or applications. List the shared objects and the local responsibilities before changing role assignments.\n\n## DSE recommendation\n\nDSE recommends reviewing the combined role assignments of each pilot administrator against a written shared-object boundary. Identify which team owns changes to common policy and how local administrators request an exception. Keep the special group and its purpose visible in the delegation documentation.\n\n## Verification\n\nWith an approved pilot account, demonstrate permitted local creation and shared-object assignment, then attempt a prohibited shared-object edit in a safe test. Investigate any unexpected capability across all role assignments. Retain the actual allowed and denied outcomes before expanding delegation.\n\n## Official references\n\n[Microsoft Learn: Distributed IT environment with many admins in the same Microsoft Intune tenant](https://learn.microsoft.com/en-us/intune/fundamentals/scale-guidelines). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-100-protect-shared-intune-policies-when-delegating-local-policy-creation/", "url": "https://update.dsesecurity.com/updates/dse-20260917-100-protect-shared-intune-policies-when-delegating-local-policy-creation/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-100-protect-shared-intune-policies-when-delegating-local-policy-creation/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Protect shared Intune policies when delegating local policy creation", "item": "https://update.dsesecurity.com/updates/dse-20260917-100-protect-shared-intune-policies-when-delegating-local-policy-creation/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-100-protect-shared-intune-policies-when-delegating-local-policy-creation/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-100-protect-shared-intune-policies-when-delegating-local-policy-creation/", "url": "https://update.dsesecurity.com/updates/dse-20260917-100-protect-shared-intune-policies-when-delegating-local-policy-creation/", "headline": "Protect shared Intune policies when delegating local policy creation", "description": "How can a distributed Intune team keep local create permissions from reaching centrally shared policies?", "abstract": "How can a distributed Intune team keep local create permissions from reaching centrally shared policies?", "articleBody": "Source facts\nMicrosoft advises giving local administrators read and assign permissions when they do not need to create, update or delete an object. For mixed local and shared management, its design places common objects on a special group outside local administrators’ RBAC scope groups. That separation prevents the local create, update and delete permissions from applying to the common objects. Microsoft Learn.\nApplicability\nUse this review when local Intune administrators need to create their own objects while assigning common centrally managed policies or applications. List the shared objects and the local responsibilities before changing role assignments.\nDSE recommendation\nDSE recommends reviewing the combined role assignments of each pilot administrator against a written shared-object boundary. Identify which team owns changes to common policy and how local administrators request an exception. Keep the special group and its purpose visible in the delegation documentation.\nVerification\nWith an approved pilot account, demonstrate permitted local creation and shared-object assignment, then attempt a prohibited shared-object edit in a safe test. Investigate any unexpected capability across all role assignments. Retain the actual allowed and denied outcomes before expanding delegation.\nOfficial references\nMicrosoft Learn: Distributed IT environment with many admins in the same Microsoft Intune tenant. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:33:20+00:00", "dateModified": "2026-09-17T16:38:46+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-100-protect-shared-intune-policies-when-delegating-local-policy-creation/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-100-protect-shared-intune-policies-when-delegating-local-policy-creation/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Protect shared Intune policies when delegating local policy creation" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 201, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Distributed IT with multiple admins - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/fundamentals/scale-guidelines" } } ] } }