MT.1103 - Ensure Intune RBAC groups are protected by Restricted Management Administrative Units or Role Assignable groups
Overview
This test checks whether Intune RBAC groups are protected either via Entra Restricted Management Administrative Unit or Role Assignable group.
Remediation action
- Add unprotected Entra security groups to a Restricted Management Administrative Unit
Additional information:
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1103 |
| Severity | High |
| Suite | Maester |
| Product | Intune |
| Related products | Entra ID |
| Feature | Tenant administration |
| Area | Privileged access |
| Resource type | Group |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1098.003 Additional Cloud Roles |
| Supports controls | nist-800-53-r5:AC-6, nist-800-53-r5:AC-3 |
| PowerShell test | Test-MtIntuneRbacGroupsProtected |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM, INTUNE_A |
Source
- Test:
tests/maester/intune/Test.MT.1103.ps1 - Documentation:
tests/maester/intune/Test.MT.1103.md