Intune RBAC & Windows Hello for Business

Who can do what in Intune?

Built-in Intune roles

Chen Wei at Meridian Bank has a team of 15 IT staff. He doesn’t want every team member to have the power to wipe 10,000 devices. Here are the built-in roles he uses:

Role	What They Can Do	Who Gets It
Intune Administrator	Everything in Intune	Chen Wei (IT Security Lead) only
Helpdesk Operator	View device/user info, perform remote actions (lock, sync, restart), reset passcodes	Helpdesk team (5 staff)
Application Manager	Manage apps: add, assign, update, delete. Can’t touch device policies.	App deployment team (2 staff)
Endpoint Security Manager	Manage security baselines, compliance policies, conditional access integration	Security team (3 staff)
Read Only Operator	View everything, change nothing	Auditors, junior staff
Policy and Profile Manager	Create and manage config profiles and compliance policies	Device config team (2 staff)
School Administrator	Manage devices and apps for education tenants	Not used at Meridian

Custom roles

If built-in roles don’t fit, you can create custom roles:

1. Intune admin center → Tenant administration → Roles → Create role
2. Pick a name and description
3. Select specific permissions (e.g., “Remote tasks: wipe = Yes, Remote tasks: retire = No”)
4. Assign the role to a group with a scope group (limits which devices they manage)

💡 Exam tip: scope tags and scope groups

RBAC in Intune has two scope concepts — don’t confuse them:

• Scope groups = which users/devices the admin can manage (e.g., “only devices in the Finance department”)
• Scope tags = which Intune objects (policies, profiles, apps) the admin can see (e.g., “only policies tagged ‘Finance’”)

Together, they create fine-grained access: an admin might only manage Finance department devices AND only see Finance-tagged policies. This is especially useful in large orgs like Meridian Bank where different teams manage different business units.

Windows Hello for Business

What is it?

Hello for Business vs regular Windows Hello

Feature	Windows Hello	Windows Hello for Business
Purpose	Consumer convenience	Enterprise security
Key storage	Software-based	TPM-backed (hardware)
Managed by	User	IT admin via Intune or GPO
Credential type	Local PIN/biometric	Asymmetric key pair + PIN/biometric
Phishing resistant	Basic	Yes — private key never transmitted
Multi-factor	No	Yes — device possession + biometric/PIN

Configuring Hello for Business with Intune

Chen Wei enables Hello for Business across all Meridian Bank devices:

1. Intune admin center → Devices → Enrollment → Windows Hello for Business

2. Configure the tenant-wide settings:

   • Enable: Yes
   • Minimum PIN length: 6 (Chen Wei sets 8 for banking compliance)
   • Maximum PIN length: 127
   • Lowercase letters in PIN: Required
   • Uppercase letters in PIN: Required
   • Special characters in PIN: Allowed
   • PIN expiration: Not configured (Microsoft recommends against PIN expiration)
   • Use biometrics: Yes
   • Use TPM: Required
   • Allow phone sign-in: No (Chen Wei blocks this for security)

3. Alternatively, create a device configuration profile or identity protection policy for group-specific settings

ℹ️ Deep dive: Hello for Business deployment models

There are several deployment models, and the exam may test awareness of them:

• Cloud-only — simplest. Entra ID + Intune. No on-prem infrastructure. Best for cloud-native orgs like CloudForge.
• Hybrid key trust — uses Entra ID + on-prem AD + Entra Connect. The on-prem DC validates the key. Common during migration.
• Hybrid certificate trust — adds PKI (certificate authority). The on-prem DC validates a certificate. More complex, needed for RDP scenarios.
• On-premises key trust — purely on-prem AD with Windows Server 2016+. No cloud dependency.

For the exam, focus on: cloud-only is simplest, hybrid key trust is most common during migration, all models require TPM 1.2 or later.

🎬 Video walkthrough

Flashcards

Question

What's the difference between scope tags and scope groups in Intune RBAC?

Click or press Enter to reveal answer

Answer

Scope groups control WHICH devices/users an admin can manage. Scope tags control WHICH Intune objects (policies, profiles, apps) an admin can see. Together, they limit both the targets and the tools an admin can access.

Click to flip back

Show hint

Question

What makes Windows Hello for Business resistant to phishing?

Click or press Enter to reveal answer

Answer

It uses asymmetric key pairs where the private key is stored in the device's TPM and never transmitted during authentication. Even if an attacker intercepts the authentication flow, they can't replay or steal the credential.

Click to flip back

Show hint

Question

Which built-in Intune role should you assign to helpdesk staff?

Click or press Enter to reveal answer

Answer

Helpdesk Operator — it allows viewing device/user information and performing remote actions (lock, sync, restart, passcode reset) without the ability to modify policies, profiles, or app assignments.

Click to flip back

Question

Does Microsoft recommend setting PIN expiration for Windows Hello for Business?

Click or press Enter to reveal answer

Answer

No. Microsoft recommends against PIN expiration. Since the PIN is hardware-backed (TPM) and only works on the specific device, it doesn't have the same risks as traditional passwords. Forcing rotation provides minimal security benefit.

Click to flip back

Knowledge Check

Knowledge Check

Chen Wei has a helpdesk team of 5 staff who need to view device information and perform remote actions like lock and restart — but must NOT be able to create or modify policies. Which approach follows the principle of least privilege?

AAssign the Global Administrator role — it includes everything they needBAssign the Intune Administrator role and verbally instruct them not to change policiesCAssign the built-in Helpdesk Operator roleDCreate individual Entra ID accounts with no roles — helpdesk staff don't need Intune access

Check Answer

Knowledge Check

Aroha at CloudForge is deploying Windows Hello for Business to her 30-person startup. All devices are cloud-native (Entra Joined, no on-prem AD). Which deployment model should she use?

AHybrid key trust — the most common modelBHybrid certificate trust — for maximum securityCCloud-only — simplest, no on-prem infrastructure neededDOn-premises key trust — most reliable for small organisations

Check Answer

---

Next up: Compliance Policies & Conditional Access — defining what “compliant” means and blocking non-compliant devices from accessing resources.