An Intune role assignment is created from the Help Desk Operator built-in role. The assignment lists the group HelpdeskAdmins as its members, a group named PerthDevices as its scope (groups), and the Default scope tag. What does the scope (groups) part of that assignment determine?
- AWhich users and devices the assigned administrators are permitted to apply those permissions to. Correct
- BWhich administrator accounts receive the permissions that the Help Desk Operator role carries.
- CWhich Intune objects, such as configuration profiles and apps, the assigned administrators can see.
- DWhich remote device actions, such as restart and sync, the assigned administrators are able to run.
Why A is correct: Correct. The scope (groups) of a role assignment is the population of users and devices the assignment reaches, so the helpdesk can act only on members of PerthDevices.
Why B is wrong: Tempting because members and scope both name Microsoft Entra ID groups, so the two fields look interchangeable. The administrators who receive the permissions are the members of the assignment, which here is HelpdeskAdmins, not the scope.
Why C is wrong: Tempting because visibility really is restricted in Intune role-based access control, but that job belongs to scope tags. An administrator sees an object when a scope tag on the object matches a scope tag on the assignment.
Why D is wrong: Tempting because the helpdesk experience is built from remote actions, but the set of allowed actions comes from the permissions in the role definition. The scope decides the targets of those actions, not the actions themselves.