Question

Your organization uses Microsoft Intune. A specialized team is responsible only for creating, editing, and assigning device compliance policies. You must grant this team the minimum permissions needed using a custom role, and you want the role to apply only to devices in the 'Sales-Devices' Entra group. What should you do?

Accepted Answer

Create a custom Intune role granting only Device compliance policy permissions, then assign it with a scope group of 'Sales-Devices'.

Answer

Assign the built-in Endpoint Security Manager role to the team scoped to the 'Sales-Devices' group.

Answer

Add the team to the Global Administrator role and use a scope tag named 'Sales'.

Answer

Create a dynamic device group for Sales and assign the built-in Help Desk Operator role.