Who is allowed to perform only specific administrative tasks within Intune?

The role of a Custom Administrator in Microsoft Intune is specifically designed to allow an individual to perform only certain administrative tasks as defined by the organization's needs. This role offers greater flexibility and control, as it enables the assignment of precise permissions tailored to the responsibilities of the user. For example, if an organization requires someone to manage application policies without granting full administrative rights, a Custom Administrator can be assigned that specific capability.

Unlike a Global Administrator, who has unrestricted access across the entire tenant and can perform any administrative task, or a Service Administrator, who may also have broad permissions, the Custom Administrator's role is focused. This is beneficial for organizations looking to enhance security by limiting access and ensuring that users only interact with the portions of the Intune platform relevant to their role.

Additionally, a User typically does not have administrative access and would not be able to perform any administrative tasks in Intune. Therefore, the Custom Administrator is the correct choice as it encapsulates the need for targeted administrative responsibilities while maintaining oversight and control.