Aug 09 2022 08:36 AM
Hello,
Added tags to some of our onboarded devices and created a device group to collect them together, all good. Created a role in endpoints\Roles and assigned it to the device group and an AAD group. Added a user to the AAD group and got them to log in expecting them to only see the devices in the Device Group, but alas no, they can see all of the devices in the inventory still, not as expected!! Am i doing something wrong or are my expectations that the documentation isn't actually telling the true story coming to fruition??
TIA
Rob
Aug 10 2022 12:29 PM
Aug 11 2022 01:58 AM
Aug 11 2022 06:17 AM
Aug 12 2022 02:27 AM
@Yong Rhee I've followed all of the steps in the microsoft docs. So i have enabled roles and created a role to be assigned to the Device group, as per the docs. I have created an AAD security group and assigned it to the Device group, as per the docs. The device group has two endpoints as per the tagging. When the user is not a member of the group they cannot see any endpoints in the portal. When they are added to the AAD group they can see all of the endpoints in the portal. I was expecting that they should be able to see the two endpoints that are in the device group, as per the docs.
Aug 12 2022 06:48 AM
Aug 12 2022 06:51 AM
Aug 12 2022 07:10 AM
I suspect that this is the issue. When you create a role to use in endpoint the default permission is 'Read Data'. You cannot remove this permission.
Aug 23 2022 04:30 AM
Oct 11 2023 04:59 AM
Good morning!
I came across this thread this morning. Thank you for raising this up to Microsoft. I am experiencing the exact same issue you described above and was hoping you could detail what you did to remediate the access issue. Seems my user is still seeing the entire inventory, so it appears one a step or two away from the resolution.
Thanks in advance for your time and assistance.
Oct 11 2023 05:27 AM
Hello,
Every device group should be assigned with users group (AZ group) even the default one (ungrouped devices) so User group column on devices group should not be empty .
Best Regards
Fadi
Oct 11 2023 06:37 AM
@Fhaddad81 thank you so much! Ensuring the user group column is not blank solved my issue. I've been working with Microsoft on this for over 3 months. Thank you for solving our problem.
Have a great day!
Glenn