Get-IntuneRbac

This script performs a comprehensive inventory of Microsoft Intune Role-Based Access Control (RBAC) by querying Microsoft Graph and exporting the results into multiple reporting formats.

Intune environments often contain dozens of custom roles, assignments, scope tags, and administrative groups that can be difficult to document and audit manually. This tool provides administrators with a complete view of who has access to what within Intune, helping improve governance, security, troubleshooting, and compliance efforts.

The script collects and correlates:
   • Role Definitions
       Retrieves all built-in and custom Intune roles, including descriptions and role identifiers.
   • Role Permissions
       Enumerates every permitted resource action assigned to each role, providing visibility into the exact administrative capabilities granted.
   • Role Assignments
       Documents all RBAC assignments, including group names and IDs for members and scopes, assigned roles, and scope tag names and IDs.
   • Scope Tags
       Inventories all Intune scope tags used for delegated administration and administrative boundaries.
   • Assignment Relationships
       Maps the relationship between administrative groups, assigned roles, scope groups, and scope tag names and IDs to show how access is delegated across the environment.

Generated reports can be used to:
   • Audit administrative privileges and delegated access
   • Validate least-privilege RBAC implementations
   • Identify excessive or unnecessary permissions
   • Document Intune administrative models for compliance reviews
   • Support security assessments and access reviews
   • Troubleshoot unexpected administrator access or permission issues
   • Create change baselines before RBAC modifications
   • Accelerate tenant migrations and environment handoffs

Output includes both human-readable CSV reports and a JSON export suitable for archival, automation, governance tooling, or integration with reporting platforms such as Power BI.

Reports generated:
   • ScopeTags.csv
       Inventory of all Intune scope tags.
   • RoleDefinitions.csv
       Inventory of all built-in and custom Intune role definitions.
   • RolePermissions.csv
       Detailed mapping of roles to Microsoft Intune resource actions.
   • RoleAssignments.csv
       Comprehensive view of RBAC assignments, members, scopes, and scope tags.
   • RBAC-Roles-Assignments-Groups.csv
       Relationship report showing delegated administration paths between groups, roles, and scopes.
   • IntuneRBAC.json
       Full RBAC configuration export for backup, analysis, or automation scenarios.

This script is particularly useful for Intune administrators, security teams, auditors, consultants, and managed service providers that need a complete understanding of delegated administration within a Microsoft Intune tenant.