> For the complete documentation index, see [llms.txt](https://docs.intuneassistant.cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.intuneassistant.cloud/security-and-compliance/role-based-access-rbac.md).
# Role Based Access (RBAC)
## Overview
Intune Assistant uses **role-based access control (RBAC)** to determine what each user can see and do inside the platform. Roles are assigned by your organisation's administrator and control access to features such as worker management, license handling, and job configuration.
Roles are managed entirely through **Microsoft Entra ID** — there is no separate role management screen inside Intune Assistant itself.
***
## Available Roles
Intune Assistant defines two roles for external organisations:
| Role | Intended for | What it enables |
| ----------------- | --------------------------------------- | ------------------------------------------------------------------------------ |
| **MspAdmin** | Managed Service Provider administrators | Full management of workers, licenses, job templates, and customer environments |
| **CustomerAdmin** | End-customer IT administrators | Read and manage the worker deployed in your own organisation |
{% hint style="info" %}
Role names are case-sensitive when assigned in Entra ID. Use exactly `MspAdmin` and `CustomerAdmin`.
{% endhint %}
***
## Role Descriptions
### MspAdmin — Managed Service Provider Administrator
This role is designed for administrators at an MSP or IT service provider who manage Intune Assistant on behalf of one or more customer organisations.
**An MspAdmin can:**
* View and manage all workers deployed across their customer environments
* Generate, assign, and revoke worker licenses
* Create and manage job templates for scheduled automation tasks
* Configure default email settings for worker notifications
* Approve and reject new worker registrations
* Trigger jobs manually or adjust schedules
**An MspAdmin cannot:**
* Access platform-level administration (reserved for Intune Assistant internally)
* Manage another MSP's workers or licenses
***
### CustomerAdmin — Customer Administrator
This role is designed for IT administrators at an end-customer organisation who need visibility into and control over the Intune Assistant worker running in their own environment.
**A CustomerAdmin can:**
* View the worker deployed in their organisation
* See job history and execution results
* Manage job schedules and settings for their own worker
* View license information for their environment
**A CustomerAdmin cannot:**
* Manage workers or licenses in other organisations
* Create or modify job templates
* Generate or revoke licenses
***
## How Role Assignment Works
Roles are assigned through **Microsoft Entra ID** — specifically through the Enterprise Application for Intune Assistant in your tenant.
### If you are an MSP assigning roles to your own team
1. Sign in to the [Azure portal](https://portal.azure.com/) with a Global Administrator or Privileged Role Administrator account
2. Go to **Microsoft Entra ID** → **Enterprise applications**
3. Search for **Intune Assistant** and open it
4. Go to **Users and groups** → **Add user/group**
5. Select the user or group you want to assign a role to
6. Under **Select a role**, choose `MspAdmin`
7. Click **Assign**
The user will have the role on their next sign-in. Existing sessions are not affected — they need to sign out and back in for the change to take effect.
### If you are a customer assigning roles to your IT team
Follow the same steps above, but select `CustomerAdmin` as the role. Your organisation must have already completed the Intune Assistant onboarding and admin consent process before roles can be assigned.
***
## Role Hierarchy
Roles are cumulative — a higher role includes everything a lower role can do:
```
MspAdmin
└─ includes everything CustomerAdmin can do, plus MSP-level management
```
There is no need to assign both roles to the same user.
***
## Frequently Asked Questions
Can I assign roles to a group instead of individual users?
Yes. In step 4 above, select a group instead of a user. All members of that group will inherit the role.
How long does it take for a role assignment to take effect?
Immediately for new sign-ins. Users who are already signed in need to sign out and back in to receive the new role.
What happens if I remove a role from a user?
The change takes effect on their next sign-in. Their current session continues to work until the token expires (typically within one hour).
Can a customer assign the MspAdmin role to themselves?
A customer tenant administrator can technically assign any role visible in their Enterprise Application. However, the MspAdmin role only grants MSP-level access within Intune Assistant if the organisation is registered as an MSP in the platform. Assigning the role label alone has no effect for non-MSP organisations.
Who can see my role assignments?
Only administrators in your own Entra ID tenant with access to Enterprise Applications can see role assignments. Intune Assistant does not display or expose role assignment information in the UI.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.intuneassistant.cloud/security-and-compliance/role-based-access-rbac.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.