How to Secure Microsoft Intune Administration Using Best Practices

Start by conducting a comprehensive audit of your current Intune role assignments. Many organizations unknowingly grant excessive privileges that violate the principle of least privilege.

Navigate to the Microsoft Intune admin center at endpoint.microsoft.com and sign in with your administrative account. Go to Tenant administration > Roles > All roles.

Review all current assignments, paying special attention to:

• Global Administrator assignments (should be minimal)
• Intune Administrator assignments (often over-assigned)
• Standing access without time limits
• Assignments not tied to specific job functions

Document each assignment with the following information:

# Use PowerShell to export current role assignments
Connect-MgGraph -Scopes "RoleManagement.Read.All"
Get-MgRoleManagementDirectoryRoleAssignment | Export-Csv -Path "C:\temp\intune-roles-audit.csv"

Remove excessive privileges: For each over-privileged assignment, click on the role > Assignments > select the user/group > Remove assignment. Document the removal with business justification.

Microsoft Intune provides several built-in roles designed for specific job functions. Assign these roles instead of broad administrative permissions.

In the Intune admin center, go to Tenant administration > Roles > All roles. Select the appropriate built-in role based on job function:

For each role assignment:

1. Click the role name > Assignments > Assign
2. Add the user or security group
3. Configure Scope (Groups) to limit which device groups this role can manage
4. Set Scope (Tags) to further restrict access by organizational unit or region

Example scope configuration:

{
  "role": "Help Desk Operator",
  "assignedTo": "HelpDesk-Level1-Group",
  "scopeGroups": ["Corporate-Devices", "BYOD-Devices"],
  "scopeTags": ["US-East", "US-West"]
}

When built-in roles don't match your organization's needs, create custom roles with precisely the permissions required.

In the Intune admin center, navigate to Tenant administration > Roles > Create > Custom role.

Define the role with these steps:

1. Basics: Enter a descriptive name like "Regional Device Manager" and description
2. Permissions: Select only the required permissions. Common custom role scenarios:

Example: Report-Only Security Analyst

{
  "roleName": "Security-Analyst-ReadOnly",
  "permissions": {
    "deviceCompliancePolicy": ["Read"],
    "deviceConfiguration": ["Read"],
    "managedApps": ["Read"],
    "reports": ["Read", "Export"],
    "auditLogs": ["Read"]
  },
  "scopeTags": ["Security-Team"]
}

Example: Limited Device Manager

{
  "roleName": "Regional-Device-Manager",
  "permissions": {
    "managedDevices": ["Read", "Update", "Retire"],
    "deviceCompliancePolicy": ["Read"],
    "deviceConfiguration": ["Read", "Assign"],
    "remoteActions": ["Sync", "Restart"]
  },
  "excludedActions": ["Wipe", "Delete", "FactoryReset"]
}

After creating the custom role:

1. Go to Assignments tab
2. Add the appropriate users/groups
3. Configure scope groups and tags to limit access
4. Set assignment type to Eligible if using PIM (covered in next step)

Implement Privileged Identity Management (PIM) to provide just-in-time access to administrative roles, reducing the attack surface of standing privileges.

Navigate to the Microsoft Entra admin center at entra.microsoft.com and go to Identity > Governance > Privileged Identity Management.

Configure PIM for Intune roles:

1. Click Microsoft Intune under Azure resources
2. Select Roles > choose the role to configure (e.g., "Intune Administrator")
3. Click Settings > Edit

Configure these critical settings:

{
  "activationSettings": {
    "maximumActivationDuration": "PT8H",
    "requireMFA": true,
    "requireJustification": true,
    "requireApproval": true,
    "approvers": ["Security-Admins-Group"]
  },
  "assignmentSettings": {
    "allowPermanentEligibleAssignment": false,
    "maximumEligibleAssignmentDuration": "P365D",
    "requireMFA": true,
    "requireJustification": true
  },
  "notificationSettings": {
    "notifyOnActivation": true,
    "notifyOnAssignment": true,
    "recipients": ["security-team@company.com"]
  }
}

Convert existing permanent assignments to eligible:

1. Go to Assignments > Eligible assignments
2. Click Add assignments
3. Select users who currently have permanent access
4. Set duration and justification requirements
5. Remove their permanent assignments after confirming eligible assignments work

Configure emergency access:

# Create break-glass accounts with permanent assignments
# These should be cloud-only accounts with strong passwords
$breakGlassAccount = "breakglass-admin@company.onmicrosoft.com"
# Document these accounts and store credentials securely

Implement strong authentication controls that resist phishing attacks by requiring hardware-based authentication methods for administrative access.

In the Microsoft Entra admin center, navigate to Protection > Conditional Access > New policy.

Create a policy specifically for Intune administrators:

Policy Name: "Intune-Admins-Phishing-Resistant-Auth"

Assignments configuration:

{
  "users": {
    "include": [
      "Intune Administrator",
      "Global Administrator",
      "Custom-Intune-Roles"
    ],
    "exclude": [
      "Break-Glass-Accounts"
    ]
  },
  "cloudApps": {
    "include": [
      "Microsoft Intune",
      "Microsoft Intune Enrollment",
      "Microsoft Entra admin center"
    ]
  },
  "conditions": {
    "locations": {
      "include": "Any location",
      "exclude": "Trusted corporate networks"
    },
    "devicePlatforms": {
      "include": "Any device"
    }
  }
}

Access controls configuration:

{
  "grantControls": {
    "operator": "AND",
    "builtInControls": [
      "requireMultiFactorAuthentication",
      "requireCompliantDevice",
      "requireHybridAzureADJoinedDevice"
    ],
    "authenticationStrength": "Phishing-resistant MFA"
  },
  "sessionControls": {
    "signInFrequency": {
      "value": 4,
      "type": "hours"
    },
    "persistentBrowser": {
      "mode": "never"
    }
  }
}

Configure phishing-resistant authentication methods:

1. Go to Protection > Authentication methods
2. Enable and configure these methods:

• FIDO2 security keys: Enable for admin accounts
• Windows Hello for Business: Require for admin workstations
• Certificate-based authentication: For smart card users

Disable weak authentication methods:

# PowerShell to disable SMS and voice for admin accounts
Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationMethod"
$adminUsers = Get-MgUser -Filter "assignedPlans/any(a:a/servicePlanId eq '12345678-1234-1234-1234-123456789012')"
foreach ($user in $adminUsers) {
    # Disable SMS authentication
    Update-MgUserAuthenticationSmsMethod -UserId $user.Id -Enabled:$false
}

Secure the devices that administrators use to access Intune by deploying hardened workstations with Microsoft security baselines.

In the Intune admin center, go to Endpoint security > Security baselines. Select the appropriate baseline for your environment:

• Microsoft Defender for Endpoint baseline
• Windows 11 Security Baseline
• Microsoft Edge baseline

Create a privileged workstation configuration profile:

1. Select Windows 11 Security Baseline > Create profile
2. Name: "Privileged-Access-Workstation-Baseline"
3. Configure these critical settings:

{
  "deviceSecurity": {
    "bitLockerEncryption": "Required",
    "secureBootEnabled": true,
    "tpmRequired": true,
    "windowsDefenderEnabled": true,
    "realTimeProtection": true
  },
  "userRights": {
    "allowLogOnLocally": ["Administrators", "Privileged-Users"],
    "denyLogOnAsService": ["Everyone"],
    "denyNetworkLogOn": ["Guests"]
  },
  "networkSecurity": {
    "windowsFirewallEnabled": true,
    "networkAccessRestricted": true,
    "remoteDesktopDisabled": true
  },
  "applicationControl": {
    "appLockerEnabled": true,
    "allowedApplications": [
      "Microsoft Edge",
      "Microsoft Office",
      "Windows Administrative Tools"
    ]
  }
}

Create a device compliance policy for privileged workstations:

1. Go to Devices > Compliance policies > Create policy
2. Platform: Windows 10 and later
3. Configure these requirements:

{
  "deviceHealth": {
    "requireBitLocker": true,
    "requireSecureBoot": true,
    "requireCodeIntegrity": true,
    "requireHealthAttestation": true
  },
  "deviceProperties": {
    "minimumOSVersion": "10.0.22000",
    "maximumOSVersion": "10.0.99999",
    "requirePasswordType": "alphanumeric",
    "minimumPasswordLength": 14
  },
  "systemSecurity": {
    "requireAntivirusEnabled": true,
    "requireAntiSpywareEnabled": true,
    "requireFirewallEnabled": true
  }
}

Assign policies to privileged user groups:

1. Create an Azure AD group: "Privileged-Access-Users"
2. Add all administrative users to this group
3. Assign both the security baseline and compliance policy to this group

Implement multi-admin approval to prevent single-person risk for critical operations like device wipes, role assignments, and script deployments.

In the Intune admin center, navigate to Tenant administration > Multi-admin approval. Click Enable multi-admin approval.

Configure approval workflows for these critical operations:

{
  "approvalWorkflows": [
    {
      "operation": "Role management",
      "description": "Creating, modifying, or deleting Intune roles",
      "enabled": true,
      "requiredApprovers": 1,
      "approverGroups": ["Security-Admins", "IT-Directors"]
    },
    {
      "operation": "Device wipe",
      "description": "Factory reset or selective wipe operations",
      "enabled": true,
      "requiredApprovers": 1,
      "approverGroups": ["Device-Managers", "Security-Team"]
    },
    {
      "operation": "Script deployment",
      "description": "PowerShell script deployment to devices",
      "enabled": true,
      "requiredApprovers": 2,
      "approverGroups": ["Security-Admins", "Change-Advisory-Board"]
    },
    {
      "operation": "Compliance policy changes",
      "description": "Modifications to device compliance policies",
      "enabled": true,
      "requiredApprovers": 1,
      "approverGroups": ["Compliance-Officers", "Security-Team"]
    }
  ]
}

Configure approver settings:

1. Click Settings in the multi-admin approval section
2. Set approval timeout: 24 hours for standard operations, 4 hours for urgent requests
3. Enable email notifications for pending approvals
4. Configure emergency override procedures

Set up emergency access procedures:

{
  "emergencyAccess": {
    "breakGlassAccounts": [
      "emergency-admin-1@company.onmicrosoft.com",
      "emergency-admin-2@company.onmicrosoft.com"
    ],
    "emergencyBypassEnabled": true,
    "postEmergencyReviewRequired": true,
    "emergencyJustificationRequired": true,
    "auditLogRetention": "P2555D"
  }
}

Test the approval workflow:

1. As a regular admin, attempt to wipe a test device
2. Verify the operation is blocked and approval request is sent
3. As an approver, review and approve the request
4. Confirm the original operation can now proceed

Set up comprehensive monitoring to detect suspicious administrative activities and potential security breaches in your Intune environment.

Configure Microsoft Defender XDR integration:

1. In the Microsoft Defender portal (security.microsoft.com), go to Settings > Microsoft 365 Defender
2. Enable Microsoft Intune data connector
3. Configure these alert rules:

{
  "alertRules": [
    {
      "name": "Suspicious Admin Activity",
      "conditions": [
        "Multiple failed admin sign-ins",
        "Admin access from unusual location",
        "Bulk device operations",
        "Role assignment changes"
      ],
      "severity": "High",
      "actions": ["Email security team", "Create incident"]
    },
    {
      "name": "Privileged Role Activation",
      "conditions": [
        "PIM role activation outside business hours",
        "Emergency access account usage",
        "Multiple role activations by same user"
      ],
      "severity": "Medium",
      "actions": ["Log to SIEM", "Notify manager"]
    }
  ]
}

Set up Intune audit log monitoring:

1. In Intune admin center, go to Tenant administration > Audit logs
2. Configure log retention and export settings
3. Set up automated monitoring for these events:

# PowerShell script to monitor critical Intune events
$criticalEvents = @(
    "Role assignment created",
    "Role assignment deleted", 
    "Device wiped",
    "Compliance policy modified",
    "Security baseline changed",
    "Conditional access policy modified"
)

# Query audit logs for critical events
Connect-MgGraph -Scopes "AuditLog.Read.All"
$auditLogs = Get-MgAuditLogDirectoryAudit -Filter "activityDisplayName in ('$($criticalEvents -join "','")') and activityDateTime ge $((Get-Date).AddHours(-24).ToString('yyyy-MM-ddTHH:mm:ssZ'))"

# Send alerts for any critical events
foreach ($log in $auditLogs) {
    Send-MailMessage -To "security-team@company.com" -Subject "Critical Intune Event Detected" -Body "Event: $($log.ActivityDisplayName) by $($log.InitiatedBy.User.UserPrincipalName)"
}

Configure sign-in risk monitoring:

1. In Microsoft Entra admin center, go to Protection > Identity Protection
2. Configure user risk policy for admin accounts:

{
  "userRiskPolicy": {
    "assignments": {
      "users": ["All admin roles"],
      "conditions": {
        "userRisk": ["High", "Medium"]
      }
    },
    "controls": {
      "access": "Block",
      "requirePasswordChange": true
    }
  },
  "signInRiskPolicy": {
    "assignments": {
      "users": ["All admin roles"],
      "conditions": {
        "signInRisk": ["High"]
      }
    },
    "controls": {
      "access": "Block"
    }
  }
}

Set up SIEM integration:

# Export Intune logs to Azure Sentinel/SIEM
$workspaceId = "your-log-analytics-workspace-id"
$workspaceKey = "your-workspace-key"

# Configure data connector for Intune logs
New-AzSentinelDataConnector -ResourceGroupName "security-rg" -WorkspaceName "security-workspace" -Kind "MicrosoftThreatIntelligence"