Scoped permissions for role-based access control moving to general availability

The Scoped permissions setting for role-based access control (RBAC) will move from public preview to general availability. Scoped permissions prevents Intune from merging permissions across multiple role assignments that share the same permission category but use different scope tags. When enabled, each role assignment's permissions apply only within its own scope tag context, giving admins exactly the access you intended.

When this feature reaches general availability, Scoped permissions will become the default behavior for all tenants.

If you haven't enabled Scoped permissions yet, use the Permissions Assessment Report at Tenant administration > Roles > Settings to preview how permissions will change before opting in.

For more information, see Permission behavior across role assignments.