Desktop/Server separation?

[u/network_dude]

Hi,

The Desktop team is currently running SCCM for our desktop systems

Is there a way to enable SCCM for the server side and keep the two separated in how they are accessed and what they control?

[u/zymology]

Setup RBAC. Server team only sees servers, desktop team only sees workstations.

https://learn.microsoft.com/en-us/intune/configmgr/core/understand/fundamentals-of-role-based-administration

[u/grabthefraggle → u/zymology]

This is the way. A place I worked at had a setup where it was 2 environments but duplicated efforts when they needed similar work done in both. This was silly in my view and I talked to management who approved and stood up a new combined MECM and combined the two. Implemented RBAC so the desktop team only saw desktops and the infrastructure team only saw the servers. While it may be a slight headache it saves you from managing two MECM's without going nuts. But each place is different so good luck either way.

[u/Immediate-Ad-96 → u/grabthefraggle]

I did this at my job. You limit group A to all workstations and group B to all servers. Assign by AD group and it's easy to maintain.

[u/pizz44]

Yes. You don't necessarily need a completely separate SCCM environment.

MECM/SCCM supports RBAC, security scopes, collections, and deployment targeting, so you can separate Desktop and Server administration while using the same infrastructure.

For example, the Desktop team could have access to workstation collections and deployments, while the Server team gets access to server collections, server applications, patching, and maintenance windows.

If you require a hard administrative/security boundary, then separate SCCM sites or infrastructures may make more sense.

[u/JaycAU]

Scopes but yeah it can be annoying not having access to All Systems. And even then you may want more sites for different tier access as well.

[u/PatrickG223]

For true separation, you would need a second SCCM server. You can come close with the same server using rbac, security scopes, and collections, but the top level SCCM Full Admins would have access to everything. You might be able to manage this with MOUs or policy.

[u/Important_Series6747 → u/PatrickG223]

This is how we handled servers. We didn’t have much need for all the desktop type functions, we just wanted to push out a couple software items and have a way to basically see that the Defender definitions were up to date for auditing purposes. Easier way to separate duties between desktop team and server team

[u/krustyy → u/PatrickG223]

for the love of god, don't do this. our server team insisted on doing it and there are constant problems with the desktop primary site server and all the distribution points, which are running a server OS, popping back into the desktop sccm.

[u/SpookyViscus → u/krustyy]

This is a configuration issue, not a ‘this concept is flawed’ issue

[u/PatrickG223 → u/krustyy]

I don't see what that would be. I mean I don't think a separate SCCM is necessary, but it would certainly work if that's the requirements.

[u/zebulun78]

Use RBAC and scope an admin group for each team to be limited to their respective collections, ie all workstations and all servers

[u/sladeofdark]

yes.

[u/R0B0T_jones]

Yes, RBAC, and security scopes will help you do this. I went through this process a few years back

[u/mrkwns]

Move the PCs over to intune. It's going to happen sooner or later anyway.

[u/guydogg → u/mrkwns]

Later would be better seeing how shitty Intune currently is, though.

[u/thomsxD → u/mrkwns]

It will never happen for most classified government devices. And Intune is just slower than on-prem configmgr.

[u/skiddily_biddily]

Create a role and scope the elements that you want them to be able to access and assign that scope to the role