In this blog post, I will show you how to create a custom role in Intune. I am confident that this guide will help Intune administrators in defining custom RBAC roles with specific set of permissions for users within their organization.
Microsoft Intune is a powerful cloud-based tool that allows organizations to manage devices, applications, and security policies. While Intune comes with built-in roles to assign permissions to users or groups, there are situations where you may need to create custom roles tailored to your organization’s unique requirements.
In my experience as an Intune consultant, I’ve observed that many organizations design custom roles in Intune (RBAC) to meet their specific business needs. While some adhere to best practices, others lack documented procedures, often causing confusion for newly onboarded administrators. Don’t worry, I will cover the procedure and best practices in this guide.
What Are Custom Roles in Intune?
Custom roles in Intune allow administrators to define specific permissions for users or groups based on their responsibilities. This ensures that users have access only to the features and data they require, enhancing security and operational efficiency.
Quoting an example from Microsoft documentation, if an IT department group manages applications, policies, and configuration profiles, you can add all those permissions together in one custom role. After creating a custom role, you can assign it to any users that require those permissions.
Intune offers both built-in and custom roles. Built-in roles are the same in all tenants and are provided to address common administrative scenarios, while custom roles you create allow for specific permissions as needed by an admin. An advantage of a custom role over a built-in role is administrators can select granular permissions for each role. But the only caveat is it requires careful planning and configuration. I also believe that assigning incorrect permissions can lead to security vulnerabilities. So keep that in mind !!
In another blog post, I will cover the differences between the built-in roles and custom roles in Intune and the pros and cons of each.
Prerequisites
Before creating custom roles in Intune, ensure the following:
- You have Global Administrator or Intune Service Administrator permissions in Azure Active Directory.
- You have access to the Microsoft Intune admin center.
- Most importantly, know the permissions that your users require.
Steps to Create a Custom Role in Intune
Custom roles can be created from the Intune admin center or using a PowerShell script. For the majority of administrators, the Intune admin center is the preferred and more user-friendly option. Follow these steps to create a new custom Intune role:
Step 1: Add a New Custom Role
Sign in to the Microsoft Intune admin center. Navigate to Tenant administration > Roles > All Roles. Click the + Create button and from the drop-down select Intune role.
Provide a name and description for the role. Make sure the name is descriptive enough to identify the purpose of the role.
Step 2: Define Role Permissions
On the Permissions page, choose the permissions you want to use with this role. You’ll notice that Permissions are grouped into several categories. Expand each category and assign the permissions based on your requirements.
Note: At this step, I recommend you carefully review the custom role permissions and select only those necessary for the role.
Step 3: Assign Scope Tags
Scope tags help you define the administrative boundaries for the role. Assign scope tags to limit the role’s access to specific groups or devices within your organization.
Step 4: Review and Create
Review the settings you’ve configured for the custom role. Should you need any changes, go back and modify them. Click Create to finalize and save the role.
To view the new custom role in the Intune admin center, go to Tenant administration > Roles > All roles. Here you should find all the built-in and custom roles. That completes the guide for creating a new custom role in Intune. In the upcoming post, I will share the steps to assign this custom role to Microsoft Entra groups.
Best Practices for Custom Roles
Based on my experience, I recommend the following best practices to be followed by organizations that use Intune custom roles.
- Follow the Principle of Least Privilege: Assign only the permissions necessary for the role to perform its tasks. Before defining the permissions, understand what that permission does and what rights does it give to the user.
- Use Scope Tags: Limit access to specific groups or devices to avoid unintended administrative actions.
- Regularly Review Roles: Periodically review custom roles to ensure they align with organizational changes and security policies. Any changes done to the permissions within the custom roles should be approved by the organization.
Conclusion
To conclude, custom roles in Intune provide flexibility and control over administrative permissions, ensuring that users only have access to the resources they need. By following the steps that I covered in this guide, you can create roles to members that meet your organization’s unique requirements while maintaining security and efficiency.
If you found this guide helpful, feel free to share it with your colleagues or reach out with any questions in the comments below!
Thank you for this helpful and well‑structured article — it really clarified several aspects of creating custom RBAC roles in Intune.
While working with custom permissions, I noticed that the Antivirus profile permissies doesn’t appear as a separate permission type in custom roles. From what I understand, Antivirus policies are still grouped under broader security permissions and don’t yet have their own granular RBAC category, unlike ASR policies.
Another thing I’ve run into is that ASR rules need to be recreated after assigning or modifying a custom role, otherwise the assigned admin cannot edit existing ASR profiles even when the correct permissions are selected.
Do you have any suggestions or best practices for handling:
The missing Antivirus permissions in custom RBAC roles, and
Scenarios where ASR rules need to be recreated after role changes?
Would appreciate your thoughts — and thanks again for the valuable content!