#Modern Workplace

When it comes to implementing least privilege model for Intune permissions, the most common way is to use the role-based access control (aka RBAC). As a focus for this article, I wanted to touch upon the permissions required for managing endpoint security related settings in Intune, but configured using Defender. Consider a scenario where security and endpoint teams are different. While Endpoint team will normally focus on the administration of managed enterprise devices using Microsoft Intune admin center, security analysts will focus on security aspect of resources using the Defender portal. The real challenge comes, when the two roles start to merge or overlap. This is where strong governance for access permissions can play a crucial role. While implementing RBAC in the respective administration portals is the recommended way to address this, in the off chance that an organization has not implemented this, the relevant permissions, for endpoint security in Intune in particular, can ...

For a long time Role-based access control (RBAC) has been the method of choice for managing access to organization's resources by using built-in Intune roles. However, there was no way to enforce just-in-time like access control against these roles. This changed earlier in the year 2023, when Microsoft released Privileged Identity Management (PIM) for Groups which allowed creating a just-in-time (JIT) policy to support a wide range of roles such as Microsoft Entra roles, Azure resource roles, Microsoft Intune and non-Microsoft application roles and services.  As of writing this blog, this feature together with PIM integration with Conditional Access went into GA which has now enabled organizations to enforce specific requirements for PIM role activations, thus enhancing the overall security posture. In this blog post, I explore these methods on how to give users just-in-time privileged access to Intune RBAC by using PIM for Groups and leveraging CA by enforcing additional secu...

On Feburary 10 2022, a new Microsoft Endpoint Manager permission was added which allows creating and editing of Win32 app supersedence and dependency relationships with other apps. If you are using RBAC within Intune, then this new permission becomes relevant to you. If you are not using RBAC, then my recommendation is to implement it, keeping in line with Microsoft's security principle of least previlege model. So what happens if you don't have the new permission enabled in RBAC? In such a case, the dependency and supesedence settings will not be available for setup or editing against Win32 apps. See below for reference. Therefore, starting in the 2202 service release, you will need to enable the 'Relate' permission against your RBAC role. This is how you can do it. 1. Navigate to Microsoft Endpoint Manager admin center . 2. Choose Tenant administration > Roles > All roles . 3. Edit your existing relevant RBAC role or create a new one if not in place. 4. Under Mo...