# Protect shared Intune policies when delegating local policy creation

> How can a distributed Intune team keep local create permissions from reaching centrally shared policies?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-100-protect-shared-intune-policies-when-delegating-local-policy-creation/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:20+00:00
- Modified: 2026-09-17T16:38:46+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

How can a distributed Intune team keep local create permissions from reaching centrally shared policies?

## Potentially affected

Use this review when local Intune administrators need to create their own objects while assigning common centrally managed policies or applications. List the shared objects and the local responsibilities before changing role assignments.

## DSE recommendation

DSE recommends reviewing the combined role assignments of each pilot administrator against a written shared-object boundary.

## Article

## Source facts

Microsoft advises giving local administrators read and assign permissions when they do not need to create, update or delete an object. For mixed local and shared management, its design places common objects on a special group outside local administrators’ RBAC scope groups. That separation prevents the local create, update and delete permissions from applying to the common objects. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/fundamentals/scale-guidelines).

## Applicability

Use this review when local Intune administrators need to create their own objects while assigning common centrally managed policies or applications. List the shared objects and the local responsibilities before changing role assignments.

## DSE recommendation

DSE recommends reviewing the combined role assignments of each pilot administrator against a written shared-object boundary. Identify which team owns changes to common policy and how local administrators request an exception. Keep the special group and its purpose visible in the delegation documentation.

## Verification

With an approved pilot account, demonstrate permitted local creation and shared-object assignment, then attempt a prohibited shared-object edit in a safe test. Investigate any unexpected capability across all role assignments. Retain the actual allowed and denied outcomes before expanding delegation.

## Official references

[Microsoft Learn: Distributed IT environment with many admins in the same Microsoft Intune tenant](https://learn.microsoft.com/en-us/intune/fundamentals/scale-guidelines). Source reviewed September 17, 2026.

## Primary reference

- Name: Distributed IT with multiple admins - Microsoft Intune | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/intune/fundamentals/scale-guidelines
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Protect shared Intune policies when delegating local policy creation,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-100-protect-shared-intune-policies-when-delegating-local-policy-creation/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.