Tuesday, 17 March 2026

Intune’s Scoped permissions preview contains RBAC access within tagged assignments

17 March was primarily a Microsoft Learn maintenance day: all 22 recorded items were updates, with no new, removed, or Message Center entries. Most remaining edits are wording, formatting, or metadata, but the Scope Tags and RBAC material documents an opt-in Scoped permissions preview with concrete evaluation and delegation guidance. Additional actionable updates cover Apple VPP licensing and Configuration Manager firewall prerequisites.

• Intune · Tenant administration

  Scoped permissions preview contains permissions within each scope tag

  The Scope Tags reference describes an opt-in public preview. Under the documented default behavior, permissions from multiple role assignments using different scope tags but the same permission category can be merged, granting broader access than intended. When Scoped permissions is enabled, each assignment remains confined to its own scope-tag context. The documentation directs administrators to Tenant administration > Roles > Settings > Permissions Assessment Report to preview the impact and says this behavior is

• Intune · Tenant administration

  RBAC guidance now distinguishes effective and assignment-level permission views

  The RBAC reference identifies the monitoring path as Tenant administration > Roles > Monitor. It describes My permissions as the signed-in user’s effective permissions view and Roles by permission as the view of permissions granted by each role assignment. This is a documentation clarification that helps administrators trace access; it is not evidence of a separate RBAC capability launch.

• Intune · Fundamentals

  Custom-role tables map access to Scoped permissions assessment and enablement

  The Create Custom Role reference now states that Organization Read also allows viewing the Scoped permissions setting and running the Permissions Assessment Report, while Organization Update also allows enabling Scoped permissions. The clarification gives administrators a precise way to review delegated access around the preview workflow.

• Intune · App management

  VPP guidance warns against mixing device and user licenses

  The iOS VPP Apps guidance adds a note telling administrators to avoid assigning both device licenses and user licenses to the same device or user because doing so can lead to unexpected behavior. This is operational guidance, not a stated licensing-enforcement change.

• Configuration Manager · Device security

  Configuration Manager firewall policies now list Endpoint Protection prerequisites

  Before creating Windows Firewall policies, the updated procedure says to have a site system server with the Endpoint Protection role installed and an Endpoint Protection Client Setting with “Manage Endpoint Protection client on client computers” set to “Yes.” It explicitly clarifies that “Install Endpoint Protection client” does not need to be enabled.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.