Terms of Delegated Administration for Microsoft Intune
If you choose to authorize a partner to be a delegated administrator on behalf of your organization, the partner will have full administrative access to Microsoft Intune as well as to any other services and subscriptions where you authenticate with the same user account. Administrative access can include functions such as assigning and maintaining user accounts, adding or removing users and groups, uploading and distributing licensed software to designated users.
“Customer”, “you”, or “your” refers to the entity agreeing to these terms. If you are accepting these terms on behalf of your employer or another legal entity, you represent and warrant that you have the authority to bind that entity and that you are agreeing to these terms on behalf of that entity. If you cannot truthfully make these representations, do not accept these terms.
Note of caution regarding authorizing a delegated administrator
If you opt to authorize a delegated administration partner, do so carefully. Microsoft provides customers, who may not wish to perform certain administration functions on their services account(s), the ability to authorize a delegated administrator to perform these functions (“delegated administrator”).
Before doing so, you must read and agree to these terms on behalf of your organization.
What functions may a delegated administrator perform?
A person or entity authorized as a delegated administrator can perform all administrative operations related to your Intune service account(s), just as you (the Customer) would be permitted to do.
Administrative operations can include, but are not limited to, creation of users and user groups, uploading and distributing licensed software to designated users, tracking your license agreement information, maintaining an inventory of licensed software assets, managing updates, or configuring policy settings.
What are some benefits of selecting a delegated administrator?
Selecting a delegated administrator familiar with administering service accounts may free you from having to learn to perform these functions yourself and may enable you to obtain support services from the delegated administrator.
What are some risks of selecting a delegated administrator?
Because a delegated administrator will have full administrative access to your Intune service account as well as to any other service authenticating with the same user account, the delegated administrator will have access to all customer data associated with those services and subscriptions.
Depending on the nature of the subscription or service, you may suffer direct or indirect harm if the delegated administrator fails to provide certain functions, e.g., if the delegated administrator does not apply security updates in a timely manner or the delegated administrator does not monitor the anti-malware status of your managed devices.
A delegated administrator could, because of its role, accidentally or intentionally harm your organization through loss or misuse of your (customer’s) data. There is nothing in the system to prevent this.
Microsoft does not approve, monitor, or manage the delegated administrator.
If you elect to de-authorize a previously authorized delegated administrator, Microsoft will make all reasonable attempts to do so promptly. However, this removal is not instantaneous and during the removal process period, the delegated administrator will continue to have full access to your organization’s services accounts and subscriptions.
How do I disable a delegated administrator?
You may disable a delegated administrator's access to your service account at any time.
To disable a delegated administrator's access, see “Remove a Delegated Administrator” in the online Help.
The option to authorize a partner to perform delegated administration is for your convenience only. You are not obligated to select or authorize a delegated administrator and, if a delegated administrator is selected, you may remove a partner as a delegated administrator at any time. Selection of a delegated administrator will not affect or alter the relationship between your organization and any other partners (except to the extent such delegated administrator selection is to replace an existing delegated administrator).
The relationship between your organization and a delegated administrator is defined by the separate oral or written agreement(s) between them. Microsoft has no involvement in your customer relationship with the delegated administrator. In the event of an issue arising from a delegated administrator's services or failure to provide services, your organization’s sole recourse is with the delegated administrator.
Microsoft bears no responsibility whatsoever for acts or omissions of a delegated administrator. Your selection or non-selection of a delegated administrator will not alter the relationship between Microsoft and you (the customer) as spelled out in the applicable services agreement, except as stated in these Terms.
DISCLAIMER OF WARRANTIES
MICROSOFT DOES NOT ENDORSE AND MAKES NO REPRESENTATIONS OR WARRANTIES WITH RESPECT TO THE SERVICES PROVIDED BY A PARTNER (IF ANY). WITHOUT LIMITING THE FOREGOING, MICROSOFT DISCLAIMS ANY AND ALL LIABILITY ARISING OUT OF YOUR (CUSTOMER'S) USE OF A PARTNER. ALL PARTNER SERVICES ARE PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND.
LIMITATION OF LIABILITY
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, WHATEVER THE LEGAL BASIS FOR THE CLAIM, NEITHER MICROSOFT NOR ANY OF ITS AFFILIATES OR SUPPLIERS WILL BE LIABLE FOR DAMAGES (INCLUDING, WITHOUT LIMITATION, DIRECT, INDIRECT, CONSEQUENTIAL, SPECIAL OR INCIDENTAL DAMAGES, DAMAGES FOR LOST PROFITS OR REVENUES, BUSINESS INTERRUPTION, OR LOSS OF BUSINESS INFORMATION) ARISING FROM OR IN CONNECTION WITH ANY ACT OR OMISSION BY A PARTNTER PROVIDING SERVICES TO CUSTOMER.
On behalf of your organization, you explicitly acknowledge that your organization:
understands the partner it authorizes will have full administration privileges for your organization’s account, including the ability to access or migrate any or all of your organization’s data;
understands that Microsoft is not responsible for any acts or omissions of the partner that the your organization have authorized; and
has read and understands these terms.