Privileged Identity Management is enforced for Intune Administrator role assignments

Overview

The Intune Administrator role grants tenant-wide write access to every device-management surface — compliance policies, app deployment, device wipes, RBAC roles, automatic enrollment, and security baselines — so a single compromised assignment is sufficient to weaponise the entire managed fleet. When the role is granted as a permanent active assignment (instead of via Microsoft Entra Privileged Identity Management (PIM) eligibility), every credential-theft event against a privileged admin is an immediate path to full tenant compromise: the threat actor does not need to wait for an elevation prompt, request approval, or re-authenticate to begin wiping devices, pushing malicious apps to every enrolled endpoint, or escalating other accounts into the role. PIM disrupts this kill chain by enforcing that the role is held as eligible, not active: the admin must explicitly request activation each time, the activation gate requires re-authentication (typically MFA + justification + time-bounded window), every activation is logged for security review, and stolen long-lived tokens cannot exercise the privilege without going through the activation step. Without PIM coverage on the Intune Administrator role, the entire tenant control plane sits behind nothing more than the admin’s password and the prevailing Conditional Access posture — a posture that does not survive token theft, session-cookie replay, or phishing-resistant MFA bypass via attacker-in-the-middle.

Remediation

• What is Microsoft Entra Privileged Identity Management?
• Assign Microsoft Entra roles in PIM
• Configure Microsoft Entra role settings in PIM (activation rules)
• Intune Administrator role permissions
• Role-based access control with Microsoft Intune
• Manage emergency access accounts in Microsoft Entra ID

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	Devices
Category	Devices
Product	Entra ID
Feature	Privileged Identity Management
Area	Privileged access
ATT&CK	T1098.003 Additional Cloud Roles, T1078.004 Cloud Accounts
Licence	INTUNE_A&AAD_PREMIUM_P2
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.