25 lines
973 B
Markdown
25 lines
973 B
Markdown
# Plan: Intune RBAC Backup (Role Definitions + Assignments) (030)
|
|
|
|
**Branch**: `feat/030-intune-rbac-backup`
|
|
**Date**: 2026-01-04
|
|
**Input**: [spec.md](./spec.md)
|
|
|
|
## Approach
|
|
1. Confirm Graph API details for RBAC:
|
|
- `deviceManagement/roleDefinitions`
|
|
- `deviceManagement/roleAssignments`
|
|
- required permissions, paging, and any known restrictions
|
|
2. Decide modeling:
|
|
- policy types (in Policy inventory) vs foundation types (backup-only)
|
|
3. Add config/contract entries with restore mode `preview-only`.
|
|
4. Implement snapshot capture with careful sanitization (no secrets, no tokens).
|
|
5. Implement restore preview dependency checks:
|
|
- groups referenced by assignments
|
|
- scope tags / scope members
|
|
6. Add targeted tests for inventory + backup + preview.
|
|
|
|
## Decisions / Notes
|
|
- Default to `preview-only` for execution due to high blast radius.
|
|
- Prefer mapping by stable identifiers (roleDefinition roleKey/displayName) and treat ambiguity as a block.
|
|
|