# Ensure Intune RBAC groups are protected by Restricted Management Administrative Units or Role Assignable groups

This test checks whether Intune RBAC groups are protected either via Entra Restricted Management Administrative Unit or Role Assignable group.

Source: https://maester.dev/docs/tests/MT.1103

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/nicolonsky" title="Nicola Suter · Original author"><img src="https://github.com/nicolonsky.png" alt="Nicola Suter" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/nicolonsky">Nicola Suter</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Intune · Tenant administration · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1103
```

## Overview

This test checks whether Intune RBAC groups are protected either via Entra Restricted Management Administrative Unit or Role Assignable group.

#### Remediation action

* Add unprotected Entra security groups to a Restricted Management Administrative Unit

Additional information:

* See [Restricted management administrative units in Microsoft Entra ID - Microsoft Learn](https://learn.microsoft.com/entra/identity/role-based-access-control/admin-units-restricted-management)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1103 |
| Severity | High |
| Suite | Maester |
| Product | Intune |
| Related products | Entra ID |
| Feature | Tenant administration |
| Area | Privileged access |
| Resource type | Group |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1098.003 Additional Cloud Roles |
| Supports controls | nist-800-53-r5:AC-6, nist-800-53-r5:AC-3 |
| PowerShell test | [Test-MtIntuneRbacGroupsProtected](https://github.com/maester365/maester/blob/main/tests/maester/intune/Test.MT.1103.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM, INTUNE_A |

</details>

## Source

- Test: [`tests/maester/intune/Test.MT.1103.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/intune/Test.MT.1103.ps1)
- Documentation: [`tests/maester/intune/Test.MT.1103.md`](https://github.com/maester365/maester/blob/main/tests/maester/intune/Test.MT.1103.md)