Forum Discussion
Device Groups not working as expected
yongrheemsft I've followed all of the steps in the microsoft docs. So i have enabled roles and created a role to be assigned to the Device group, as per the docs. I have created an AAD security group and assigned it to the Device group, as per the docs. The device group has two endpoints as per the tagging. When the user is not a member of the group they cannot see any endpoints in the portal. When they are added to the AAD group they can see all of the endpoints in the portal. I was expecting that they should be able to see the two endpoints that are in the device group, as per the docs.
Microsoft- They are not in any admin groups, i'll raise a ticket
I suspect that this is the issue. When you create a role to use in endpoint the default permission is 'Read Data'. You cannot remove this permission.
- OK, I now have the answer!
Every Device group you create has to have an assigned AAD group (for RBAC) including the Unassigned DG
Every AAD group has to be assigned to an MDE created Role
The AAD group can have zero members, e.g. when used with the Unassigned DG so no-one apart from Admins can see the inventory.