Merge pull request #6623 from tktracker/patch-2

Update assign-role.md

Author: Angela Fleischmann

memdocs/intune/fundamentals/assign-role.md

@@ -40,15 +40,20 @@ To create, edit, or assign roles, your account must have one of the following pe
 
 2. On the **Endpoint Manager roles - All roles** blade, choose the built-in role you want to assign > **Assignments** > **+ Assign**.
 
-5. On the **Basics** page, enter an **Assignment name** and optional **Assignment description**, and then choose **Next**.
+3. On the **Basics** page, enter an **Assignment name** and optional **Assignment description**, and then choose **Next**.
 
-6. On the **Admin Groups** page, select the group that contains the user you want to give the permissions to. Choose **Next**
+4. On the **Admin Groups** page, select the group that contains the user you want to give the permissions to. Choose **Next**.
 
-7. On the **Scope (Groups)** page, choose a group containing the users/devices that the member above will be allowed to manage. You also have the option to choose all users and/or all devices. Choose **Next**.
+5. On the **Scope (Groups)** page, choose a group containing the users/devices that the member above will be allowed to manage. You also have the option to choose all users and/or all devices. Choose **Next**.
+  
+      > [!NOTE] 
+      > The **All users** and **All devices** are [Intune virtual groups](groups-add.md) and not Azure Active Directory (Azure AD) security groups. As a result, for **Scope (Groups)** assignment purposes you cannot use them as parents of Azure AD security groups. If you need both **All users** and **All devices** and specific Azure AD security groups for **Scope (Groups)** assignments, you must add them separately with separate assignments. Otherwise, even if the **Scope (Groups)** assignment for a role is set to **All Users** the admin in this role won't have access to specific Azure AD user groups.
+      >  
+      > For Azure AD security groups, nesting is supported.
 
-8. On the **Scope (Tags)** page, choose tags where this role assignment will be applied. Choose **Next**.
+7. On the **Scope (Tags)** page, choose tags where this role assignment will be applied. Choose **Next**.
 
-9. On the **Review + Create** page, when you're done, choose **Create**. The new assignment is displayed in the list of assignments.
+8. On the **Review + Create** page, when you're done, choose **Create**. The new assignment is displayed in the list of assignments.
 
 ## Next steps
 - [Learn more about role-based access control in Intune](role-based-access-control.md)