You have a Microsoft 365 subscription that contains two security groups named Group1 and Group2.

To assign roles in Intune to meet the requirements, you should assign the following roles to each group:

Group1: Intune Role Administrator Group2: Help Desk Operator

The Intune Role Administrator role is the only Intune role that can manage custom Intune roles and add assignments for built-in Intune roles1. This role meets the requirement for Group1 to manage Intune roles and assignments.

The Help Desk Operator role can perform remote tasks on users and devices, and can assign applications or policies to users or devices1. This role meets the requirement for Group2 to assign existing apps and policies to users and devices.