Include exclusion groups in an Intune administrator's assignment scope

Source facts

Microsoft requires an exclusion group to be nested within an RBAC assignment scope group or listed separately as a scope group in that role assignment. Microsoft advises limiting scope groups to the users and devices that the administrator should manage. Microsoft Learn.

Applicability

Use this check when delegated Intune administrators manage policy or app assignments that exclude a security group. Review the role assignment used by that administrator alongside the target assignment.

DSE recommendation

DSE recommends reviewing inclusion and exclusion targets together when delegating assignment management. Map each required exclusion group to the administrator’s approved scope, and document whether coverage comes from nesting or an explicit scope-group entry. Ask the access owner to resolve a missing group within that intended boundary before expanding the administrator’s authority.

Verification

Using an approved delegated test account, inspect the relevant policy or app assignment and verify that the intended inclusion and exclusion groups can be managed. Compare the resulting role scope with the approved group list, including an unrelated group that should remain outside it. Retain the effective assignment evidence with the delegation record.

Official references

Microsoft Learn: Role-based access control (RBAC) with Microsoft Intune. Source reviewed September 17, 2026.