👋 Introduction

October 2026

This feature is currently an opt-in public preview.

Scoped Permissions is an advanced capability of Intune Scope Tags, which are used to limit what admins can see and manage in different parts of your Intune environment. Scope Tags help you separate administrative responsibilities by assigning resources, such as devices, apps or policies, to specific groups of administrators.

Traditionally, if an admin received multiple role assignments, Intune would combine the permissions from those assignments. This could sometimes result in broader access than intended. For example, an admin with read-only access in one scope and full management permissions in another could end up receiving the higher permissions across both scopes.

Scoped Permissions changes this behavior by keeping permissions tied to the specific scope tag and role assignment they belong to. Instead of merging permissions across assignments, each assignment applies only within its own scope.

In simple terms, Scope Tags determine where an admin has access, while Scoped Permissions determine what an admin can do within that specific scope. This gives you more precise control and helps ensure admins have exactly the level of access you intended.

Example

Imagine an admin is assigned:

• Read Only Operator for resources tagged Headquarters
• Application Manager for resources tagged Regional Office

Without Scoped Permissions, Intune combines the permissions from both role assignments. As a result, the admin could receive the higher Application Manager permissions across both scope tags, allowing them to modify apps in Headquarters even though they were only intended to have read-only access there.

With Scoped Permissions enabled, the permissions remain separate. The admin would have:

• Read-only access to apps tagged Headquarters
• Full application management permissions for apps tagged Regional Office

This ensures access is granted exactly as intended and prevents permissions from bleeding into other scope tag areas.

⚙️ Configuration

DANGER

Enabling this is a one-time tenant action that cannot be undone.

Before enabling this setting, use the Permissions Assessment Report to preview exactly how permissions will change for each affected admin in your tenant. You can find the report directly beneath the enabling button labeled Generate Report (See Screenshots below).

1. To enable Scoped Permissions, you open the Intune admin center -> Tenant administration -> Roles -> Settings
2. Click Enable scoped permissions and confirm the action in the pop-up window with Enable.

💡 Conclusion

Great addition to Intune RBAC and pushing Zero Trust forward. It is really how Scope Tags should have always worked and the activation is a general no-brainer for most companies. If you are using Scope Tags today, make sure to check beforehand with the report how it affects your admins, so as not to lock your admins out.

References

• Micrososft Learn - Use role-based access control (RBAC) and scope tags for distributed IT
• Micrososft Learn - Scoped permissions