Skip to content
Romy
Deutsch

1Intune setup (RBAC)

Who it is for

For your Intune admin. The first setup needs the Intune Administrator role, after that “Romy App Installer” is enough.

Why

This is where you decide who may deploy Romy and which devices it reaches. The scripts in the Intune setup do it without a secret.

  1. 4Intune admin

    Create groups, scope tag and role

    The role “Romy App Installer” sets what the admin account may do, which is 5 permissions. The group “Romy Pilot Devices” sets on which devices. You create both yourself. Romy writes nothing into your tenant.

    How to do it

    1. Download and unzip the Intune setup of the current release.
    2. Run Install-Module Microsoft.Graph.Authentication -Scope CurrentUser once.
    3. Run 1-gruppen-und-rolle.ps1 -Geraete PC-01 -Admins it@firma.de, first with -WhatIf and then without.
    Time
    10 minutes
    Check
    Intune → Tenant administration → Roles → “Romy App Installer”. You see 5 permissions, the scope “Romy Pilot Devices” and the tag ROMY.
    Undo
    Delete the role assignment, the role and scope tag ROMY. Delete both groups in Entra ID.
    romy-intune-einrichtung-26.10.4.zipRomy 26.10.4 „Arber“ · stabil · 15.10.2026 · 18.1 KB
    Microsoft Intune admin centersimplified
    Tenant administration › Roles › Romy App Installer
    PermissionsMobile apps: Read · Create · Update · Assign
    Managed devices: Read
    AssignmentMembers: Romy Intune Admins
    Scope (groups)Romy Pilot Devices
    Scope tagROMY

    What the script needs at sign-in. Delegated means only what your own account may do anyway

    • Group.ReadWrite.All

      Required
      Type
      Delegated
      What for
      Create and fill the groups “Romy Pilot Devices” and “Romy Intune Admins”

    • Device.Read.All

      Required
      Type
      Delegated
      What for
      Find the devices you name with -Geraete

    • User.Read.All

      Required
      Type
      Delegated
      What for
      Find the admin accounts you name with -Admins

    • DeviceManagementRBAC.ReadWrite.All

      Required
      Type
      Delegated
      What for
      Create scope tag ROMY, the role “Romy App Installer” and its assignment

    What the role “Romy App Installer” allows, and nothing more

    • Microsoft.Intune_MobileApps_Read

      Required
      Type
      Intune role
      What for
      See the Romy app in Intune

    • Microsoft.Intune_MobileApps_Create

      Required
      Type
      Intune role
      What for
      Create the Win32 app the first time

    • Microsoft.Intune_MobileApps_Update

      Required
      Type
      Intune role
      What for
      Replace the content, which updates to a new release

    • Microsoft.Intune_MobileApps_Assign

      Required
      Type
      Intune role
      What for
      Assign “Required” to “Romy Pilot Devices”

    • Microsoft.Intune_ManagedDevices_Read

      Required
      Type
      Intune role
      What for
      Check install status per device

    Next, step 5, Deploy the Romy App for Windows

  2. 10Intune adminoptionalAccess level 4

    Act through Intune with a service account

    For actions Intune itself performs, such as a remote restart. The role “Romy Geräteaktionen” only allows reading and restarting, and only in the pilot group.

    How to do it

    1. Run 4-dienstkonto-rolle.ps1 -Dienstkonto romy@company.com.
    2. The service account signs in once to “Romy Dienstkonto”.
    Time
    10 minutes
    Check
    Intune → Roles → “Romy Geräteaktionen”. You see 2 permissions and the pilot group as scope.
    Undo
    Delete the role assignment or disable the service account.

    Permissions in this step

    • Microsoft.Intune_ManagedDevices_Read

      optional
      Type
      Intune role
      What for
      See devices in the pilot group

    • Microsoft.Intune_RemoteTasks_RebootNow

      optional
      Type
      Intune role
      What for
      Restart a device in the pilot group, nothing else

    • DeviceManagementManagedDevices.PrivilegedOperations.All

      optional
      Type
      Delegated
      What for
      The app “Romy Dienstkonto” may never do more than the service account’s role allows: restart, pilot group only

    • offline_access

      optional
      Type
      Delegated
      What for
      Stay signed in without asking each time

    Next, step 11, Install a new release