Role Based Access (RBAC)
Overview
Intune Assistant uses role-based access control (RBAC) to determine what each user can see and do inside the platform. Roles are assigned by your organisation's administrator and control access to features such as worker management, license handling, and job configuration.
Roles are managed entirely through Microsoft Entra ID — there is no separate role management screen inside Intune Assistant itself.
Available Roles
Intune Assistant defines two roles for external organisations:
MspAdmin
Managed Service Provider administrators
Full management of workers, licenses, job templates, and customer environments
CustomerAdmin
End-customer IT administrators
Read and manage the worker deployed in your own organisation
Role names are case-sensitive when assigned in Entra ID. Use exactly MspAdmin and CustomerAdmin.
Role Descriptions
MspAdmin — Managed Service Provider Administrator
This role is designed for administrators at an MSP or IT service provider who manage Intune Assistant on behalf of one or more customer organisations.
An MspAdmin can:
View and manage all workers deployed across their customer environments
Generate, assign, and revoke worker licenses
Create and manage job templates for scheduled automation tasks
Configure default email settings for worker notifications
Approve and reject new worker registrations
Trigger jobs manually or adjust schedules
An MspAdmin cannot:
Access platform-level administration (reserved for Intune Assistant internally)
Manage another MSP's workers or licenses
CustomerAdmin — Customer Administrator
This role is designed for IT administrators at an end-customer organisation who need visibility into and control over the Intune Assistant worker running in their own environment.
A CustomerAdmin can:
View the worker deployed in their organisation
See job history and execution results
Manage job schedules and settings for their own worker
View license information for their environment
A CustomerAdmin cannot:
Manage workers or licenses in other organisations
Create or modify job templates
Generate or revoke licenses
How Role Assignment Works
Roles are assigned through Microsoft Entra ID — specifically through the Enterprise Application for Intune Assistant in your tenant.
If you are an MSP assigning roles to your own team
Sign in to the Azure portal with a Global Administrator or Privileged Role Administrator account
Go to Microsoft Entra ID → Enterprise applications
Search for Intune Assistant and open it
Go to Users and groups → Add user/group
Select the user or group you want to assign a role to
Under Select a role, choose
MspAdminClick Assign
The user will have the role on their next sign-in. Existing sessions are not affected — they need to sign out and back in for the change to take effect.
If you are a customer assigning roles to your IT team
Follow the same steps above, but select CustomerAdmin as the role. Your organisation must have already completed the Intune Assistant onboarding and admin consent process before roles can be assigned.
Role Hierarchy
Roles are cumulative — a higher role includes everything a lower role can do:
There is no need to assign both roles to the same user.
Frequently Asked Questions
Can I assign roles to a group instead of individual users?
Yes. In step 4 above, select a group instead of a user. All members of that group will inherit the role.
How long does it take for a role assignment to take effect?
Immediately for new sign-ins. Users who are already signed in need to sign out and back in to receive the new role.
What happens if I remove a role from a user?
The change takes effect on their next sign-in. Their current session continues to work until the token expires (typically within one hour).
Can a customer assign the MspAdmin role to themselves?
A customer tenant administrator can technically assign any role visible in their Enterprise Application. However, the MspAdmin role only grants MSP-level access within Intune Assistant if the organisation is registered as an MSP in the platform. Assigning the role label alone has no effect for non-MSP organisations.
Last updated