Question

Contoso has a central IT team and a separate helpdesk team based in the Madrid office. All company devices are enrolled in Microsoft Intune. You must ensure the Madrid helpdesk can only view and manage the devices and policies that belong to the Madrid region, while the central IT team retains full visibility across all objects. You have already created a custom Intune role with the appropriate remote actions. What should you configure to restrict the Madrid helpdesk to only their regional objects?

Accepted Answer

Create a scope tag for Madrid, assign it to the Madrid devices and policies, and include that scope tag in the role assignment for the Madrid helpdesk group.

Answer

Create a dynamic device group for Madrid devices and add it as the only member group in the Madrid helpdesk role assignment.

Answer

Enable multi-admin approval for device actions so the central IT team must approve any changes made by the Madrid helpdesk.

Answer

Assign the built-in Help Desk Operator role to the Madrid helpdesk group scoped to all devices.