Assigning Intune and Cloud PC Roles with Least Privilege

MD-102 By islever Editorial Last updated

Short answer

E Create a custom Microsoft Entra role and assign the role to Admin1.

Question

You have a Microsoft 365 E5 subscription that includes Microsoft Intune and contains a user named Admin1. Admin1 must use the Microsoft Intune admin center to perform the following tasks: • Create and assign apps and policies to users and devices by using Intune. • Create, assign, and delete Windows 365 Cloud PC provisioning policies. You need to assign the required roles to Admin1. The solution must meet the following requirements: • Follow the principle of least privilege. • Minimize administrative effort. What should you do?
  1. Assign Admin1 the Help Desk Operator role.
  2. Assign Admin1 the Cloud PC Reader role.
  3. Assign Admin1 the Cloud PC Administrator role.
  4. Create a custom Microsoft Entra role and assign the role to Admin1.
  5. Create a custom Intune role and assign the role to Admin1. Correct Answer

Key Takeaways

Tests the boundary between Intune Administrator and Cloud PC Administrator roles; the trap is assuming one built-in role handles all Microsoft 365 admin tasks.

Determines the correct role assignment for managing both Microsoft Intune apps/policies and Windows 365 Cloud PC provisioning. Establishes that no single built-in role covers both scopes, necessitating a custom Entra ID role.

Common mistake: Selecting 'Cloud PC Administrator' because it covers Cloud PC policies but fails to grant permissions for creating/assigning Intune apps.

Expert Analysis

Why the Answer Is Correct

The question requires Admin1 to perform two distinct functions: manage Intune apps/policies (Intune scope) and manage Windows 365 Cloud PC provisioning policies (Windows 365 scope). The built-in 'Intune Administrator' role does not include permissions to manage Windows 365 Cloud PCs, and the 'Cloud PC Administrator' role does not include permissions to manage Intune apps. Therefore, neither built-in role alone satisfies the requirements. Creating a custom Microsoft Entra role allows you to combine the specific permissions from both domains into a single assignment, satisfying the principle of least privilege by granting only what is needed.

Why the Other Options Are Wrong

Option C (Cloud PC Administrator) is incorrect because it lacks the necessary permissions to create or assign Intune applications and policies. Option A (Help Desk Operator) is too limited, typically allowing only password resets and basic device management, not app creation. Option D is technically similar to E but uses incorrect terminology; these are Custom Built-in Roles in Entra ID, not generic 'Microsoft Entra roles' separate from the RBAC system. Option E is the precise technical solution.

Community Comment Notes

Several users initially voted for C, believing the Cloud PC Administrator role was sufficient. However, comments correctly pointed out that this role cannot manage Intune apps. One user noted, "None of the built in roles can satisfy both requirements," which aligns with the official documentation. Another user clarified that while custom roles require more setup, they are the only way to meet both functional requirements without excessive privileges.

Official Reference

https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always check if a single built-in role covers all listed responsibilities. If the tasks span different services (e.g., Intune vs. Windows 365), look for a custom role option to combine permissions while maintaining least privilege.

Frequently Asked Questions

Why isn't Cloud PC Administrator enough?

It manages Cloud PC provisioning but lacks permissions to create or assign Intune applications and policies.

Does creating a custom role violate least privilege?

No, it grants only the specific combined permissions needed, avoiding the excess access found in broader built-in roles like Global Administrator.

More MD-102 FAQ →

Community Votes

E
57%
C
43%

57% of anonymous learners picked answer E. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. chafe 👍 3 Answered E
    https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control None of the built in roles can satisfy both requirements, answer is correct
  2. jdr002 👍 2
    Answer is correct "E". Cloud PC admin doesn't have the capability to assign applications. https://learn.microsoft.com/en-us/windows-365/enterprise/role-based-access
  3. Meek_Learner 👍 1 Answered C
    The Cloud PC Administrator role provides the necessary permissions to create, assign, and delete Windows 365 Cloud PC provisioning policies. This role also includes the ability to manage apps and policies in Intune, which covers the requirement to create and assign apps and policies to users and devices. By assigning this built-in role, you minimize administrative effort as you don't need to create a custom role. The Cloud PC Administrator role follows the principle of least privilege by granting only the permissions needed for Admin1's specific tasks without providing unnecessary access to other areas of the system.
  4. 59c6be3_111 👍 1 Answered C
    Should be C in my opinion. E would be ideal and the best way but the question states that it should minimize admin effort. Creating a custom role does not fulfill that requirement. In that case we can also remove D. That leaves A / B / C. Helpdesk role can assign apps and policies to users but it CAN'T create apps and policies, which is a requirement. Cloud PC Reader has only read access as the name suggest, can't creat anything. That leaves Cloud PC Administrator, hence answer should be C. https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control#roles
  5. pri27 👍 1 Answered E
    Chatgpt said C but Deepseek said E its said its not C bcoz, Cloud PC Administrator Role: While this role allows managing Cloud PC provisioning policies, it does not cover the permissions needed for creating and assigning apps and policies in Intune.
Show 2 more comments
  1. yhano 👍 1 Answered C
    Custom indeed is a solution but that requires more effort. If you assign the cloud administrator it will cover the required action at thesame time principle of least privilege plus minimize admin effort.
  2. powered 👍 1 Answered D
    I was wonder whether it's D sound like we can tailor-made the permissions to Admin1 needs to perform those tasks, without granting excessive access....

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

SCEP Root Certificate Location for Intune

S-grade

How Many Intune Profiles Are Needed for Cloud PKI User Certificates?

S-grade

What Must Be Purchased First for Intune Device Query at Minimum Cost?

S-grade

Intune Bulk Custom Notifications Supported Devices

S-grade

Practice All MD-102 Questions

Access 92 questions with complete answers and detailed explanations.

View Full MD-102 Practice Test →

← Back to MD-102 Study Guide