Feature Request - Backup of Intune Roles and Scope Tags

[gmenziesint]

Hi,

We've been looking to backup our current Roles and Scopes using IntuneCD, I'm unable to find this currently in the backups so we're requesting this feature, if it's available please let me know where it's located.

Below are the MS Graph queries to pull this information.

Scope Tags
https://learn.microsoft.com/en-us/graph/api/intune-rbac-rolescopetag-list?view=graph-rest-beta

Roles and Role Assignments
https://learn.microsoft.com/en-us/graph/api/intune-rbac-deviceandappmanagementroledefinition-get?view=graph-rest-1.0&tabs=http
https://learn.microsoft.com/en-us/graph/api/intune-rbac-deviceandappmanagementroleassignment-get?view=graph-rest-1.0&tabs=http

Thanks so much!

[almenscorner]

I will look into this as soon as time allows :)

[almenscorner]

Also requested in #161

[almenscorner]

This feature is now included in the latest beta, please do a test run and verify that the roles are backed up to a folder named Roles.

To test, install the latest beta: pip3 install IntuneCD==2.0.9b1 and run a backup.

[CubeWT]

Thanks for the quick beta update.
I haven't requested the feature originally but i'm also interested to export / import of roles and scopes.

To export the roles the App registrations needs DeviceManagementRBAC.Read.All or DeviceManagementRBAC.ReadWrite.All correct?

[almenscorner]

It should be enough with DeviceManagementConfiguration.Read.All

[almenscorner]

Never mind, yes you are right

[almenscorner]

Question here, would it be enough just to export the custom roles as you cannot do much with the built in ones either way?

[CubeWT]

For me this would be enough.

[gmenziesint]

We currently don't use the built-in roles for anything but for sure custom roles are the main driver for this so I'd say only custom roles would be great. Thank you

[almenscorner]

Beta 2 is now pushed, this update includes the following updates:

• Group IDs in roles backup is now converting to group names
• Only custom roles are now backed up
• Added updating/removal/creation of roles
• Role exports are cleaned up a bit to get rid of unnecessary properties

[gmenziesint]

Great thank you!

[almenscorner]

Can also confirm that changing the assignment to a group that exists fixes it

[gmenziesint]

Tested this now with All devices assigned to the Scope Group for the failing policy and can confirm it's working. :)

[almenscorner]

It is fixed in beta 3 being pushed now, also, backup/update of Scope Tags is included in beta 3!

[gmenziesint]

Tested Beta 3, can confirm I can see Scope Tags backed up, I'm unable to test the null Scope groups as we've made the change our end now but great to have it in place for edge cases. Thanks for the prompt turn around!