Review copied permissions and tags before assigning a cloned Intune role

Source facts

Duplicating an Intune role preselects all permissions and scope tags from the original. The duplicate’s name, description, permissions, and tags can then be changed. Microsoft requires a unique name. Where Multi Admin Approval protects RBAC changes, a second administrator’s approval is required before the protected change takes effect. Microsoft Learn.

Applicability

Use this review when a current role is a starting point for a different job function. Define the new operator’s permitted tasks and intended resource scope before copying the role.

DSE recommendation

Prepare a comparison that separates permissions to keep, remove, and add. Review copied tags independently from action permissions; a familiar role name is not a sufficient description of its contents. Give the duplicate a purpose-specific description and have the service owner justify any destructive or assignment-related capability. Keep the original role unchanged unless a separate approved request covers it.

Verification

Compare the saved duplicate with the approved permission-and-tag list before assigning it to a pilot operator. Rehearse required tasks and selected prohibited tasks on nonproduction resources with that account. Examine its other assignments when interpreting the outcome, and document any unexpected capability for investigation. Retain the source role identity, reviewed differences, and actual pilot results so future administrators can understand why the clone exists rather than assuming it is an interchangeable copy.

Official references

Microsoft Learn: Create a custom role in Intune.