Block access to Endpoint Manager Admin Center for non admin users

%3CLINGO-SUB%20id%3D%22lingo-sub-2196393%22%20slang%3D%22en-US%22%3EBlock%20access%20to%20Endpoint%20Manager%20Admin%20Center%20for%20non%20admin%20users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2196393%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20all%2C%3CBR%20%2F%3EIs%20there%20any%20way%20I%20can%20completely%20block%20access%20to%20the%20Endpoint%20Manager%20Admin%20Center%20for%20non%20admin%20users%3F%20While%20most%20of%20the%20information%20in%20Endpoint%20Manager%20is%20blocked%20for%20non%20admin%20users%20(Reports%2C%20All%20Devices%2C%20All%20Apps%20etc)%2C%20currently%20non%20admin%20users%20can%20access%20individual%20users%20in%20Endpoint%20Manager%20via%20Users%20%26gt%3B%20All%20Users%20and%20can%20view%20almost%20all%20information%20of%20individual%20users%20(User%20Profile%2C%20Devices%2C%20Groups%2C%20Licenses%2C%20Applications%20etc).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMaybe%20someone%20has%20a%20quick%20idea%20on%20this%20as%20our%20works%20council%20is%20very%20unhappy%20with%20this....%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ebest%20regards%3CBR%20%2F%3ELars%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2196393%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EIntune%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2196571%22%20slang%3D%22en-US%22%3ERe%3A%20Block%20access%20to%20Endpoint%20Manager%20Admin%20Center%20for%20non%20admin%20users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2196571%22%20slang%3D%22en-US%22%3EYou%20can%20block%20access%20to%20AAD%2C%20cfr%20Azure%20AD%20blade%20-%26gt%3B%20User%20Settings%20-%26gt%3B%20Restrict%20access%20to%20Azure%20AD%20administration%20portal.%3CBR%20%2F%3E%3CBR%20%2F%3EI%20think%20this%20should%20also%20block%20access%20to%20users%2Fgroups%20(but%20I%20have%20not%20tested%20it)%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2196609%22%20slang%3D%22en-US%22%3ERe%3A%20Block%20access%20to%20Endpoint%20Manager%20Admin%20Center%20for%20non%20admin%20users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2196609%22%20slang%3D%22en-US%22%3EHi%2C%20Thijs%20Lecomte%2C%20thy%20for%20your%20fast%20reply%2C%20but%20this%20only%20blocks%20access%20to%20Azure%20AD%20Admin%20Portal%20not%20the%20access%20to%20Endpoint%20Manager.%20I%C2%B4ve%20tested%20this%20minutes%20before....%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2196614%22%20slang%3D%22en-US%22%3ERe%3A%20Block%20access%20to%20Endpoint%20Manager%20Admin%20Center%20for%20non%20admin%20users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2196614%22%20slang%3D%22en-US%22%3EDarn%2C%20I%20hoped%20this%20would%20be%20a%20solution.%3CBR%20%2F%3EThen%20there%20isn't%20any%20way%20to%20block%20this%20AFAIK...%3CBR%20%2F%3EOthers%20might%20have%20solutions%20though...%3C%2FLINGO-BODY%3E
Occasional Contributor

Hi all,
Is there any way I can completely block access to the Endpoint Manager Admin Center for non admin users? While most of the information in Endpoint Manager is blocked for non admin users (Reports, All Devices, All Apps etc), currently non admin users can access individual users in Endpoint Manager via Users > All Users and can view almost all information of individual users (User Profile, Devices, Groups, Licenses, Applications etc).

 

Maybe someone has a quick idea on this as our works council is very unhappy with this....

 

***Update, Problem fixed***

Apparently I was too fast testing yesterday after enabling the user setting (Restrict access to Azure AD administration portal). Tested this again today and it works!!! Now a normal user without rights has no access to the data.

 

Thanks to all who supported me!!!

***********************************

best regards
Lars

 

9 Replies
You can block access to AAD, cfr Azure AD blade -> User Settings -> Restrict access to Azure AD administration portal.

I think this should also block access to users/groups (but I have not tested it)
Hi, Thijs Lecomte, thy for your fast reply, but this only blocks access to Azure AD Admin Portal not the access to Endpoint Manager. I´ve tested this minutes before....
Darn, I hoped this would be a solution.
Then there isn't any way to block this AFAIK...
Others might have solutions though...
Anyway thanks for your help, hopefully someone else has an idea..

Hi @LarsWe 

 

I have not implemented this approach myself but you may want to look into Scope tags, here is a pretty good overview on how to do that: Intune scope tags and role-based access control explained.

Hi Alo Press,
nice consideration, but unfortunately it does not help in my case. I created an additional Intune role as a test, since roles can't be created without permissions I gave the role read permissions for TermsAndConditions. After creating a scope and assigning it to the group my test user is in, the permission of the user has changed from "no permission" to "TermsAndConditions - read"... Unfortunately this process did not change the possibility that the user can still view all information via "Users > All Users...".

It is also strange that in other areas of the portal immediately "No access" is displayed. Is this a BUG in the portal?

Hi @LarsWe 

 

You could try a Conditional Access policy towards Intune and only add proper roles to the Allowed list or Block everyone excluding (Intune) admins. But please be careful to not lock yourself out. Docs for Common Conditional Access policies.

 

Policy could be something like this:

  • Users and groups: Include All users, Exclude Admins
  • Cloud apps: Select apps "Microsoft Intune"
  • Grant: Block access

I would recommend testing with a limited scope and you might want to add other conditions such as platforms or Locations/networks. Also enforcing MFA for Azure access would probably be a good idea in general. 

Hi Alo Press,
I have already tested this. Unfortunately without success, but I am also not sure if the CloudApp "Intune" really means the Endpoint Manager Admin Center...?

Hmm, yeah, wasn't able to find specific documentation on the "Intune" Enterprise app but found something that might overlap with some of your needs, check out this docs page on Manage access to Azure management with Conditional Access. The page does not exactly list Endpoint Manager but it might be implied through some overarching management portal.