Assigning Intune and Cloud PC Roles with Least Privilege

Answer Correct answer: E — Create a custom Microsoft Entra role and assign the role to Admin1.

You have a Microsoft 365 E5 subscription that includes Microsoft Intune and contains a user named Admin1. Admin1 must use the Microsoft Intune admin center to perform the following tasks: • Create and assign apps and policies to users and devices by using Intune. • Create, assign, and delete Windows 365 Cloud PC provisioning policies. You need to assign the required roles to Admin1. The solution must meet the following requirements: • Follow the principle of least privilege. • Minimize administrative effort. What should you do?

Assign Admin1 the Help Desk Operator role.
Assign Admin1 the Cloud PC Reader role.
Assign Admin1 the Cloud PC Administrator role.
Create a custom Microsoft Entra role and assign the role to Admin1.
Create a custom Intune role and assign the role to Admin1. Correct Answer

intune role based access control cloud pc administrator role custom entra id role md-102 microsoft 365 least privilege

Community Votes

57%

43%

57% of anonymous learners picked answer E. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Tests the boundary between Intune Administrator and Cloud PC Administrator roles; the trap is assuming one built-in role handles all Microsoft 365 admin tasks.

Determines the correct role assignment for managing both Microsoft Intune apps/policies and Windows 365 Cloud PC provisioning. Establishes that no single built-in role covers both scopes, necessitating a custom Entra ID role.

Selecting 'Cloud PC Administrator' because it covers Cloud PC policies but fails to grant permissions for creating/assigning Intune apps.

Community Discussion (7 comments)

pri27 👍 1 Selected: E

Chatgpt said C but Deepseek said E its said its not C bcoz, Cloud PC Administrator Role: While this role allows managing Cloud PC provisioning policies, it does not cover the permissions needed for creating and assigning apps and policies in Intune.

Meek_Learner 👍 1 Selected: C

The Cloud PC Administrator role provides the necessary permissions to create, assign, and delete Windows 365 Cloud PC provisioning policies. This role also includes the ability to manage apps and policies in Intune, which covers the requirement to create and assign apps and policies to users and devices. By assigning this built-in role, you minimize administrative effort as you don't need to create a custom role. The Cloud PC Administrator role follows the principle of least privilege by granting only the permissions needed for Admin1's specific tasks without providing unnecessary access to other areas of the system.

powered 👍 1 Selected: D

I was wonder whether it's D sound like we can tailor-made the permissions to Admin1 needs to perform those tasks, without granting excessive access....

59c6be3_111 👍 1 Selected: C

Should be C in my opinion. E would be ideal and the best way but the question states that it should minimize admin effort. Creating a custom role does not fulfill that requirement. In that case we can also remove D. That leaves A / B / C. Helpdesk role can assign apps and policies to users but it CAN'T create apps and policies, which is a requirement. Cloud PC Reader has only read access as the name suggest, can't creat anything. That leaves Cloud PC Administrator, hence answer should be C. https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control#roles

yhano 👍 1 Selected: C

Custom indeed is a solution but that requires more effort. If you assign the cloud administrator it will cover the required action at thesame time principle of least privilege plus minimize admin effort.

jdr002 👍 2

Answer is correct "E". Cloud PC admin doesn't have the capability to assign applications. https://learn.microsoft.com/en-us/windows-365/enterprise/role-based-access

chafe 👍 3 Selected: E

https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control None of the built in roles can satisfy both requirements, answer is correct

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

The question requires Admin1 to perform two distinct functions: manage Intune apps/policies (Intune scope) and manage Windows 365 Cloud PC provisioning policies (Windows 365 scope). The built-in 'Intune Administrator' role does not include permissions to manage Windows 365 Cloud PCs, and the 'Cloud PC Administrator' role does not include permissions to manage Intune apps. Therefore, neither built-in role alone satisfies the requirements. Creating a custom Microsoft Entra role allows you to combine the specific permissions from both domains into a single assignment, satisfying the principle of least privilege by granting only what is needed.

Why the Other Options Are Wrong

Option C (Cloud PC Administrator) is incorrect because it lacks the necessary permissions to create or assign Intune applications and policies. Option A (Help Desk Operator) is too limited, typically allowing only password resets and basic device management, not app creation. Option D is technically similar to E but uses incorrect terminology; these are Custom Built-in Roles in Entra ID, not generic 'Microsoft Entra roles' separate from the RBAC system. Option E is the precise technical solution.

Community Comment Notes

Several users initially voted for C, believing the Cloud PC Administrator role was sufficient. However, comments correctly pointed out that this role cannot manage Intune apps. One user noted, "None of the built in roles can satisfy both requirements," which aligns with the official documentation. Another user clarified that while custom roles require more setup, they are the only way to meet both functional requirements without excessive privileges.

Official Reference

https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control

Exam Strategy

Always check if a single built-in role covers all listed responsibilities. If the tasks span different services (e.g., Intune vs. Windows 365), look for a custom role option to combine permissions while maintaining least privilege.

Frequently Asked Questions

Why isn't Cloud PC Administrator enough?

It manages Cloud PC provisioning but lacks permissions to create or assign Intune applications and policies.

Does creating a custom role violate least privilege?

No, it grants only the specific combined permissions needed, avoiding the excess access found in broader built-in roles like Global Administrator.

Related Analysis

Practice All MD-102 Questions

Access 92 questions with complete answers and detailed explanations.

View Full MD-102 Practice Test →

← Back to MD-102 Study Guide