Protect shared Intune policies when delegating local policy creation

Source facts

Microsoft advises giving local administrators read and assign permissions when they do not need to create, update or delete an object. For mixed local and shared management, its design places common objects on a special group outside local administrators’ RBAC scope groups. That separation prevents the local create, update and delete permissions from applying to the common objects. Microsoft Learn.

Applicability

Use this review when local Intune administrators need to create their own objects while assigning common centrally managed policies or applications. List the shared objects and the local responsibilities before changing role assignments.

DSE recommendation

DSE recommends reviewing the combined role assignments of each pilot administrator against a written shared-object boundary. Identify which team owns changes to common policy and how local administrators request an exception. Keep the special group and its purpose visible in the delegation documentation.

Verification

With an approved pilot account, demonstrate permitted local creation and shared-object assignment, then attempt a prohibited shared-object edit in a safe test. Investigate any unexpected capability across all role assignments. Retain the actual allowed and denied outcomes before expanding delegation.

Official references

Microsoft Learn: Distributed IT environment with many admins in the same Microsoft Intune tenant. Source reviewed September 17, 2026.