MT.1103: Ensure Intune RBAC groups are protected by Restricted Management Administrative Units or Role Assignable groups
| ID | MT.1103 |
| Severity | High |
| Suite | Mito |
| Product | Intune |
| Related products | Entra ID |
| Feature | Tenant administration |
| Security area | Privileged access |
| Resource type | Group |
| User impact of fixing | Low |
| Effort to fix | Medium |
| Framework controls | nist-800-53-r5:AC-6 Least Privilegenist-800-53-r5:AC-3 Access Enforcement |
| MITRE ATT&CK | T1098.003 |
| Reads from | Microsoft Graph |
| Licence needed | AAD_PREMIUM, INTUNE_A |
What this checks and how to fix it
Section titled “What this checks and how to fix it”This test checks whether Intune RBAC groups are protected either via Entra Restricted Management Administrative Unit or Role Assignable group.
Remediation action
Section titled “Remediation action”- Add unprotected Entra security groups to a Restricted Management Administrative Unit
Additional information:
Mito check. Author: nicolonsky. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.