Delegation in Intune is two questions asked separately: what an administrator may do, and which objects exist for them at all. The scoped-permissions change finally makes the answers honest.
For years the network and the identity were governed separately, and the seam between them was where attackers lived. Global Secure Access closes that seam by making the network path itself something the identity system authorizes.
Every control produces a record, and a control whose record no one keeps is one you are only assuming works. Watching identity turns the directory's exhaust into something you can alert on and answer questions with later.
Bringing an outsider into your directory is a trust decision wearing the clothes of a convenience feature. External identity is deciding how much of someone else's security posture you will inherit as your own.
Access is not an event, it is a lifespan. Access reviews and lifecycle workflows make provisioning, recertification, and deprovisioning something the platform runs rather than something people remember to do.
Most access is granted by hand and never taken back. Entitlement management turns access into a governed object with a requester, an approver, a reason, and an expiry.
Delegation is giving people exactly the authority their job requires and not a scrap more, because the width of a role assignment is the width of a breach.
Privilege is the one thing you want people to have and not hold. PIM separates being entitled to a role from possessing it, so power is reached for deliberately, briefly, and on the record.
