Ensure Intune RBAC groups are protected by Restricted Management Administrative Units or Role Assignable groups
MT.1103HighIntuneTenant administration
Part of Maester · Intune · Tenant administration · All checks
Invoke-Maester -TestId MT.1103Overview
Section titled “Overview”This test checks whether Intune RBAC groups are protected either via Entra Restricted Management Administrative Unit or Role Assignable group.
Remediation action
Section titled “Remediation action”- Add unprotected Entra security groups to a Restricted Management Administrative Unit
Additional information:
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | MT.1103 |
| Severity | High |
| Suite | Maester |
| Product | Intune |
| Related products | Entra ID |
| Feature | Tenant administration |
| Area | Privileged access |
| Resource type | Group |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1098.003 Additional Cloud Roles |
| Supports controls | nist-800-53-r5:AC-6, nist-800-53-r5:AC-3 |
| PowerShell test | Test-MtIntuneRbacGroupsProtected |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM, INTUNE_A |
Source
Section titled “Source”- Test:
tests/maester/intune/Test.MT.1103.ps1 - Documentation:
tests/maester/intune/Test.MT.1103.md