How can I use RBAC to exclude access to a collection in SCCM 1710?

[letsgoflyers81]

I know I can use Security Roles and Scopes to give administrative users access to only certain collections (for example only desktops or only servers), but I need to allow access to All Systems except for a single collection.

My operational team are Full Administrators since they handle most day to day activites. However I'm considering adding some clients to the environment that I don't want them to be able to manage, deploy software or updates to, etc. I thought about copying the Full Administrator role and assigning it a new scope, but since they need access to the All Systems collection, any clients in this new collection would be there as well so I think they'd have access.

Is there an easy way to do this that I'm missing? Thanks!

[GarthMJ]

Ok, I will bite, Why do they need to the All Systems collection? If you write your All Workstations / All Server collections correctly, there should be no need for this. except in rare cases. Then you are the overall admin, will fix it for them. 

[letsgoflyers81]

2 hours ago, GarthMJ said:

Ok, I will bite, Why do they need to the All Systems collection? If you write your All Workstations / All Server collections correctly, there should be no need for this. except in rare cases. Then you are the overall admin, will fix it for them. 

As of right now my environment only manages workstations and the team I want to limit handles almost all of our BAU activities.  Because of that, most collections are limited against All Systems and the team has access to everything.  I'm looking into properly implementing RBAC in the near future which will require modifying most existing collections, deployments, admin users, etc. so I was hoping there would be an easier workaround for what I'm trying to do.

[GarthMJ]

I'm not following you as to why they need access to the All Systems collection.  Why exactly do they need access to the All System collection? 

What is BAU? 

[letsgoflyers81]

On 5/2/2018 at 11:01 AM, GarthMJ said:

I'm not following you as to why they need access to the All Systems collection.  Why exactly do they need access to the All System collection? 

What is BAU? 

Until now the team has been responsible for all SCCM management except for OSD so there was no reason to limit their access.  I'm not against removing their access to All Systems now, but wouldn't I need to change the limiting collection of every collection that uses it?

BAU means business as usual, day to day work such as software packaging and deployment, Windows updates, reporting and monitoring, etc.

[GarthMJ]

Yes, you would need to adjust all collections to the newly created collection.  In most companies that leverage RBA fully, only a handful of people have access to All Systems.