Delegate admin permissions to groups

You and your IT staff manage multiple groups of students, teachers, and administrators throughout your school.

Unlike IT staff, admin groups only manage the groups you assign to them. When you give admin permissions to a group of qualified individuals, you help reduce the risk of unauthorized or accidental changes.

Group admin permissions

Group admins are assigned in Intune for Education and have permission to manage school devices and apps. Group admins can:

  • View information about devices, users, and apps.
  • Assign, create, delete, view, and update device and user settings.
  • Assign, create, delete, view, and update apps.
  • View reports.
  • Take remote actions on devices, including resetting to factory settings, rebooting, locking an unlocked device, and forcing a sync.
  • Create, delete, view, and update the iOS MDM Push Certificate, iOS MDM server tokens, and iOS VPP tokens.

Tip

Modifying admin permissions is an advanced task. If you want to change the permissions or create a custom set of permissions, then you need to go to the full management experience in Intune. These permissions comprise the built-in School Administrator role in Intune.

Assign an admin group

  1. From the Intune for Education dashboard, click Groups.
  2. Choose a group. This group will be the one your admins manage.
  3. Click the Admins tab > Add Admins.
  4. Choose a group to give it admin permission to manage apps and settings.
  5. Click Choose group.

Remove an admin group

  1. From the Intune for Education dashboard, click Groups.
  2. Choose a group. This group will be the one you remove an admin group from managing.
  3. Click the Admins tab.
  4. Select one or more groups from the list of admins. Then click Remove Admins.