Intune RBAC permission reference

MicrosoftAllows creation of new device management administrative tasks

MicrosoftAllows deletion of device management administrative tasks

In practiceRemoves the task for every admin, so work someone still needed to do can disappear from the queue.

MicrosoftAllows read access to device management administrative tasks

MicrosoftAllows updating of device management administrative task properties and status

In practiceChanging a task's status (for example, marking it complete) changes it for everyone. Treat this as "can close out other people's work."

MicrosoftAllows Intune to assign devices to Microsoft Entra ID groups during enrollment.

In practiceLets an admin configure enrollment so new devices land in Entra groups automatically, and those groups drive which apps and policies the devices get.

MicrosoftView the Android Enterprise configuration used to sync applications with the Managed Google Play store or view the Android Enterprise enrollment prerequisites and enrollment profiles.

MicrosoftManage or change the Managed Google Play configuration used to sync applications with the Managed Google Play store, or sync the apps you approved from the store with Intune.

MicrosoftManage or change Android Enterprise Device Owner enrollment profiles used to enroll devices.

In practiceEnrollment profiles (and their tokens and QR codes) decide how new corporate Android devices enroll. A changed or leaked profile affects every device enrolled with it afterward.

MicrosoftManage or change the Android Enterprise binding to Managed Google Play and other account-wide configurations.

In practiceThis is the tenant-wide link to Google. Unbinding or rebinding it disrupts Android Enterprise management and app delivery for every Android device.

MicrosoftManage or change the connection to Google's Zero-Touch Enrollment (ZTE) portal.

In practiceControls how factory-fresh devices bought through zero-touch resellers enroll. A wrong change affects every new device out of the box.

MicrosoftAssign Android firmware over-the-air (FOTA) deployments to Microsoft Entra security groups.

In practiceAssigning a firmware deployment is what actually pushes new firmware to devices. Firmware can't easily be rolled back.

MicrosoftCreate and manage all aspects of Android firmware over-the-air (FOTA) deployments.

MicrosoftDelete and cancel pending Android firmware over-the-air (FOTA) deployments and delete deployment history.

In practiceAlso deletes deployment history, which removes the record of what firmware went where.

MicrosoftView Android firmware over-the-air (FOTA) deployments, including history and reporting.

MicrosoftChange existing Android firmware over-the-air (FOTA) deployments and cancel firmware deployments.

In practiceChanges to a deployment that's already assigned take effect on its targeted devices.

MicrosoftAssign App Control for Business profiles to Microsoft Entra security groups.

In practiceAn app control policy on the wrong devices can stop line-of-business apps, or even Windows components, from running. Pilot first.

MicrosoftCreate new App Control for Business profiles.

In practiceCreating a profile has no effect until it's assigned, which makes Create a safe permission to give policy authors who don't deploy.

MicrosoftDelete App Control for Business profiles.

In practiceDeleting an assigned profile removes that app control protection from every device it targeted.

MicrosoftRead App Control for Business profiles.

In practiceShows exactly which apps and publishers you allow, which is useful to an attacker planning around your controls.

MicrosoftUpdate App Control for Business profiles.

In practiceEdits to an assigned profile go to devices right away. One rule change can block or allow software across the fleet.

MicrosoftGenerate, view, or export reports for App Control for Business profiles.

MicrosoftAssign Attack Surface Reduction (ASR) profiles to Microsoft Entra security groups.

In practiceASR rules in block mode can break legitimate apps and macros. Assign deliberately, starting in audit mode.

MicrosoftCreate new Attack Surface Reduction (ASR) profiles.

In practiceNo effect until assigned.

MicrosoftDelete Attack Surface Reduction (ASR) profiles.

In practiceDeleting an assigned profile quietly removes hardening from every device it targeted.

MicrosoftRead Attack Surface Reduction (ASR) profiles.

MicrosoftUpdate Attack Surface Reduction (ASR) profiles.

In practiceFlipping a rule from audit to block (or back) changes protection on every assigned device.

MicrosoftGenerate, view, or export reports for Attack Surface Reduction (ASR) profiles.

MicrosoftView all Intune audit data for this tenant.

In practiceRead-only, but it's all audit data for the tenant regardless of scope tags, including admin names and every change. Good for auditors; not needed by most operators.

MicrosoftAdd, remove, or modify certificate connectors required to support certificate issuance.

In practiceRemoving or misconfiguring a connector stops certificate issuance and renewal, which can take down Wi-Fi, VPN, and email authentication as certificates expire.

MicrosoftView certificate connectors required to support certificate issuance.

MicrosoftDelete the organization's Chrome Enterprise connection settings.

In practiceDisconnects ChromeOS reporting and actions from Intune for the whole tenant.

MicrosoftView the organization's Chrome Enterprise connection settings and device details for Chrome OS devices.

MicrosoftManage or change the organization's Chrome Enterprise connection settings.

MicrosoftEnrolls an eligible CM device into comanagement.

In practiceChanges how the device is managed. Workloads move to Intune according to your co-management settings.

MicrosoftWill hide or show the CMPivot blade.

In practiceCMPivot runs live queries against devices: files, registry, services, installed software. It's read-only, but very detailed and real-time.

MicrosoftWill hide or show the Run script action in the Scripts blade.

In practiceRuns Configuration Manager scripts on devices from the cloud console. Script execution is effectively administrator access to the device.

MicrosoftWill hide or show the actions available in the Applications blade.

In practiceLets an admin install or uninstall applications on Configuration Manager devices from Intune.

MicrosoftWill hide or show the Applications blade.

MicrosoftWill hide or show the Client details blade.

MicrosoftWill hide or show the Collections blade.

MicrosoftWill hide or show the Resource explorer blade.

In practiceResource explorer shows full hardware and software inventory for a device.

MicrosoftWill hide or show the Scripts blade.

MicrosoftWill hide or show the Software updates blade.

MicrosoftWill hide or show the Timeline blade.

MicrosoftCreate certificate authorities (CAs)

In practiceA new CA becomes a source of certificates your devices and services may trust for Wi-Fi, VPN, and app authentication. Creating CAs is a PKI design decision, not an operational task.

MicrosoftDisable and reenable CAs

In practiceA disabled CA stops issuing and renewing certificates. Anything that depends on them (Wi-Fi, VPN, certificate-based sign-in) starts failing as certificates expire.

MicrosoftRead CAs and the leaf certificates issued by them

In practiceShows your CA hierarchy and every certificate issued from it, including which users and devices hold them.

MicrosoftRevoke issued leaf certificates

In practiceRevoking a certificate immediately breaks whatever that device or user was authenticating with it. That's the right call for a lost device, and an outage if done to the wrong ones.

MicrosoftCreate new corporate device identifiers or import a CSV file containing a list of corporate device identifiers.

In practiceDevices on this list enroll as corporate-owned. That changes what Intune can collect and do (for example, full app inventory) and can let devices past enrollment restrictions that block personal devices.

MicrosoftDelete IMEI or serial numbers used as corporate device identifiers.

MicrosoftView the IMEI or serial numbers used as corporate device identifiers.

MicrosoftChange IMEI or serial numbers used as corporate device identifiers.

MicrosoftAssign customization options for the Company Portal.

In practiceTargets a branding profile to groups. Low risk, but it does control the contact details and links users see when they need help.

MicrosoftCreate customization options for the Company Portal.

MicrosoftDelete customization options for the Company Portal.

MicrosoftRead customization options for the Company Portal.

MicrosoftUpdate customization options for the Company Portal.

In practiceIncludes the IT contact and support links users see. Someone could point users at the wrong help desk or a phishing site, so don't treat this as cosmetic.

MicrosoftCreate Deployment Plans

In practiceA plan contains no app or policy, so creating one deploys nothing by itself. It does decide which groups get each wave, and in what order, for every rollout that uses it.

MicrosoftDelete Deployment Plans

In practiceRemoves the template your team uses for staged rollouts. Expect people to fall back to assigning everyone at once.

MicrosoftRead Deployment Plans

MicrosoftUpdate Deployment Plans

In practicePlans are shared templates. Changing a plan's rings, groups, or timing (for example, making "All devices" the first ring instead of the last) changes how fast and how wide every future rollout built on it goes.

MicrosoftConfigure the Derived Credentials for your Microsoft Intune tenant.

In practiceChanging the issuer affects every user who signs in or signs email with a derived credential on mobile. Changing providers typically means users have to re-enroll.

MicrosoftView the Derived Credentials for your Microsoft Intune tenant.

MicrosoftAssign device compliance policies to Microsoft Entra security groups, and assign Exchange on-premises access to Microsoft Entra security groups.

In practiceWith Conditional Access, compliance decides who can reach company resources. Assigning a strict policy to the wrong group can lock users out.

MicrosoftCreate new device compliance policies.

In practiceNo effect until assigned.

MicrosoftDelete device compliance policies or delete Exchange ActiveSync connectors.

In practiceDeleting an assigned policy changes compliance results for its devices. Deleting an Exchange connector affects on-premises mail access control.

MicrosoftView device compliance policies and the list of Exchange Active Sync Connectors, or view the settings for Exchange on-premises access.

MicrosoftChange device compliance policies, Exchange ActiveSync connectors, and Exchange on-premises access settings.

In practiceOne tightened rule (for example, minimum OS version) can mark thousands of devices noncompliant at their next check-in.

MicrosoftView, generate, and export device compliance reports.

MicrosoftAssign device configuration profiles or assign device enrollment restrictions to Microsoft Entra security groups.

In practiceThis is where configuration actually reaches devices. It also covers enrollment restrictions, which decide who can enroll at all.

MicrosoftCreate new device configuration profiles, or create new device enrollment restrictions.

In practiceNo effect until assigned.

MicrosoftDelete device configuration profiles, or delete device enrollment restrictions.

In practiceDeleting an assigned profile removes its settings from devices (depending on the setting, they may revert or stay as-is). Deleting an enrollment restriction can open enrollment to devices you meant to block.

MicrosoftView device configuration profiles, or view device enrollment restrictions.

MicrosoftChange device configuration profiles, or change device enrollment restrictions.

In practiceEdits to an assigned profile go to every targeted device at its next check-in.

MicrosoftChange Windows Backup and Restore settings.

In practiceA tenant-wide setting that controls whether users can restore their Windows backup during device setup.

MicrosoftView, generate, and export device configuration reports.

MicrosoftView the list of device enrollment manager accounts.

MicrosoftCreate new device enrollment manager accounts, or delete device enrollment manager accounts.

In practiceA DEM account can enroll far more devices than a normal user. Creating one is effectively creating a bulk-enrollment identity, so keep the list short and reviewed.

MicrosoftCreate new baselines and edit endpoint analytics settings.

In practiceNote that Create, Update, and Delete all include editing endpoint analytics settings.

MicrosoftEdit endpoint analytics settings and delete baselines.

MicrosoftView endpoint analytics scores and performance reports.

MicrosoftEdit endpoint analytics settings and baselines.

MicrosoftAssign Endpoint Detection and Response (EDR) profiles to Microsoft Entra security groups.

In practiceEDR profiles control onboarding to Defender for Endpoint. Assigning the wrong profile can take devices out of EDR coverage.

MicrosoftCreate new Endpoint Detection and Response (EDR) profiles.

In practiceNo effect until assigned.

MicrosoftDelete Endpoint Detection and Response (EDR) profiles.

MicrosoftRead Endpoint Detection and Response (EDR) profiles.

MicrosoftUpdate Endpoint Detection and Response (EDR) profiles.

In practiceChanges to an assigned profile affect your detection coverage. Security team only.

MicrosoftGenerate, view, or export reports for Endpoint Detection and Response (EDR) profiles.

MicrosoftAllows administrators to approve, deny, or revoke Endpoint Privilege Management (EPM) support approved requests from end users.

In practiceApproving a request lets a standard user run that file with administrator rights. The approver is the security control, so pick approvers who will actually check what they're approving.

MicrosoftAllows administrators to view Endpoint Privilege Management (EPM) support approved requests.

MicrosoftAllows administrators to assign Endpoint Privilege Management (EPM) policies.

In practiceAssigning an elevation rule grants admin-level execution for that file to everyone in the group.

MicrosoftAllows administrators to create Endpoint Privilege Management (EPM) policies.

In practiceNo effect until assigned.

MicrosoftAllows administrators to delete Endpoint Privilege Management (EPM) policies.

In practiceUsers who relied on a deleted elevation rule lose the ability to run that tool as admin.

MicrosoftAllows administrators to read Endpoint Privilege Management (EPM) policies.

MicrosoftAllows administrators to update Endpoint Privilege Management (EPM) policies.

In practiceA loosened rule (for example, matching on file name instead of hash or publisher) can let users elevate things you never intended.

MicrosoftAllows administrators to view Endpoint Privilege Management (EPM) reports.

MicrosoftView endpoint protection reports.

MicrosoftAssign profiles for Automated Device Enrollment, Apple School Manager, Apple Business Manager, Apple Configurator, or Windows Autopilot.

In practiceThe profile decides the device's setup experience and how it's managed from first boot (for example, supervision, user affinity, and Autopilot mode).

MicrosoftImport Apple devices for Apple Configurator.

MicrosoftCreate new profiles for the Automated Device Enrollment, Apple School Manager, Apple Configurator, or Windows Autopilot.

MicrosoftDownload the Apple Automated Device Enrollment or Apple School Manager token .pem file.

In practiceThis downloads the public key you upload to Apple Business or School Manager when you set up or renew a token. It's a setup step, not an everyday task.

MicrosoftDelete Apple devices for the Automated Device Enrollment, Apple School Manager, or Apple Configurator

MicrosoftDelete profiles for the Automated Device Enrollment, Apple School Manager, Apple Configurator, or Windows Autopilot.

MicrosoftDelete Apple Automated Device Enrollment or Apple School Manager token .pem files.

In practiceDeleting a token breaks the link to Apple Business or School Manager, and with it automated enrollment for every device behind that token.

MicrosoftAllows Intune to assign devices to Entra ID groups during enrollment.

In practiceLets an admin set enrollment to drop devices into Entra groups automatically, and those groups drive apps and policy.

MicrosoftView Apple devices for the Automated Device Enrollment, Apple School Manager, Apple Configurator, or Windows Autopilot devices.

MicrosoftView profiles for the Automated Device Enrollment, Apple School Manager, Apple Configurator, or Windows Autopilot.

MicrosoftView the Apple Automated Device Enrollment or Apple School Manager token status.

MicrosoftRelease Apple ADE (automated device enrollment) enrolled devices from Apple Business or School Manager and Intune

In practiceReleasing removes the device from your organization's Apple Business or School Manager, so it can no longer be enrolled automatically as yours. Getting it back generally means re-adding it through Apple Configurator or a reseller.

MicrosoftRotate local admin account password for macOS devices enrolled through Apple's automated device enrollment

MicrosoftInitiate the Sync command for Windows Autopilot devices.

MicrosoftManage profiles for the Automated Device Enrollment, Apple School Manager, Apple Configurator, or Windows Autopilot.

In practiceChanges apply to devices that enroll with the profile afterward.

MicrosoftUpload the Apple Device Enrollment or Apple School Manager token and sync Apple Automated Device Enrollment or Apple School Manager devices.

In practiceUploading the wrong token can connect Intune to a different Apple Business or School Manager account.

MicrosoftView local admin account password for macOS devices enrolled through Apple's automated device enrollment

In practiceA local admin password gives full control of that Mac.

MicrosoftCreate new filter. Learn more https://go.microsoft.com/fwlink/?linkid=2135625

MicrosoftDelete filters. Learn more https://go.microsoft.com/fwlink/?linkid=2135625

MicrosoftView filters. Learn more https://go.microsoft.com/fwlink/?linkid=2135625

MicrosoftEdit filters. Learn more https://go.microsoft.com/fwlink/?linkid=2135625

In practiceThe sleeper permission. Editing a filter changes the target of every assignment that uses it, across apps and policies, without touching any of those assignments.

MicrosoftView all data and reports from the data warehouse. Data can be used by Power BI or other reporting services.

In practiceRead-only, but tenant-wide bulk data about users, devices, and apps. Treat it like an export of your inventory.

MicrosoftAssign application protection policies to Microsoft Entra security groups.

In practiceApp protection controls copy/paste, save-as, PIN requirements and more in apps like Outlook and Teams. A wrong assignment can block users or leave data unprotected.

MicrosoftCreate new application protection policies.

MicrosoftDelete application protection policies.

In practiceRemoves data protection from apps for every user in scope.

MicrosoftView application protection policies and status.

MicrosoftChange application protection policies, or delete pending wipe requests for protected apps.

In practiceNote the second half: Update can cancel a pending app wipe, for example one issued for a departing employee.

MicrosoftCreate a wipe request to selectively remove company data from a protected app.

In practiceRemoves company data from the app on that user's device. It doesn't touch personal data, but the user loses company mail and files in that app until they sign in again.

MicrosoftChange the managed device cleanup rules.

In practiceAn aggressive rule removes device records automatically, including devices that are just offline for a while, such as on leave or in storage.

MicrosoftChange the managed device cleanup settings.

In practiceSame risk as cleanup rules: device records get removed automatically.

MicrosoftDelete Intune managed devices. Deleted devices can no longer be managed by Intune, and the device can no longer access company resources. Company data may be wiped from the device if a user tries to check in after it's deleted.

In practiceRead Microsoft's description twice. This is irreversible from the console, and the user typically has to re-enroll.

MicrosoftAllows Intune to query a managed device for the purposes of retrieving detailed inventory information, device state, or other properties of a managed device from the device itself.

In practiceLive, on-demand queries against the device itself (device query), not just the last inventory snapshot.

MicrosoftView Intune managed devices.

MicrosoftRead BIOS password for devices with managed BIOS and firmware configuration.

In practiceThe BIOS password protects firmware settings like boot order and Secure Boot. Anyone holding it can change them.

MicrosoftChoose, change, or remove the primary user of a managed device. This permission must be used in combination with the managed devices read and update permissions.

In practiceThe primary user drives user-targeted apps and policies, and who sees the device in Company Portal. Changing it can move a device's apps and access to someone else.

MicrosoftChange settings or ownership properties of a managed device. This permission doesn't enable remote actions for devices. To perform remote actions on the device, grant one or more of the Remote Task permissions.

In practiceIncludes switching ownership between personal and corporate, which changes what Intune collects from the device (corporate devices report full app inventory, for example).

MicrosoftGenerate, view, or export reports for managed devices.

MicrosoftModify the settings for synchronizing Managed Google Play apps with Microsoft Intune.

MicrosoftView the settings for synchronizing Managed Google Play apps with Microsoft Intune.

MicrosoftView the connection between Microsoft Intune and Microsoft Defender ATP.

MicrosoftModify the settings for synchronizing Microsoft Store for Business apps with Microsoft Intune.

In practiceMicrosoft Store for Business has been retired. There's little reason to grant this in a new role.

MicrosoftView the settings for synchronizing Microsoft Store for Business apps with Microsoft Intune.

MicrosoftCreate Microsoft Tunnel Gateway server configurations and sites. Server configurations include settings for IP address ranges, DNS servers, ports, and split tunneling rules. Sites are logical groupings of multiple servers that support Microsoft Tunnel.

MicrosoftDelete Microsoft Tunnel Gateway server configurations and sites. Server configurations include settings for IP address ranges, DNS servers, ports, and split tunneling rules. Sites are logical groupings of multiple servers that support Microsoft Tunnel.

In practiceMobile users connected through that site lose VPN access to internal resources.

MicrosoftView Microsoft Tunnel Gateway server configurations and sites. Server configurations include settings for IP address ranges, DNS servers, ports, and split tunneling rules. Sites are logical groupings of multiple servers that support Microsoft Tunnel.

In practiceShows internal IP ranges, DNS servers, and routing rules. That's network reconnaissance data, so limit it to network admins.

MicrosoftUpdate Microsoft Tunnel Gateway server configurations and sites. Server configurations include settings for IP address ranges, DNS servers, ports, and split tunneling rules. Sites are logical groupings of multiple servers that support Microsoft Tunnel.

In practiceChanging split tunneling or DNS can silently send traffic that should stay inside the tunnel out to the internet, or the reverse.

MicrosoftAssign mobile applications or eBooks to Microsoft Entra security groups.

In practiceAssign as Required installs software on every targeted device, and Uninstall removes it. This is software deployment to your fleet.

MicrosoftAdd new mobile applications to Intune such as store apps, line-of-business apps, web-links, or built-in apps. You can also add books purchased through the Apple Volume Purchase Program or add eBook categories. You can set up iOS VPP Tokens, Windows Symantec certificates, Windows side loading keys, app categories, or the Android for Work connection. See the note following this table regarding Apple Volume Purchase Program (VPP) apps.

In practiceUploading a package isn't deploying it. But a Win32 app is a script or installer that runs as SYSTEM once assigned, so know who's packaging.

MicrosoftDelete mobile applications such as store apps, line-of-business apps, web-links, or built-in apps. You can also delete books purchased through the Apple Volume Purchase Program or delete eBook categories. You can delete iOS VPP Tokens, Windows Symantec certificates, Windows side loading keys, app categories, or the Android for Work connection. See the note following this table regarding Apple Volume Purchase Program (VPP) apps.

In practiceAlso covers deleting VPP tokens, which affects licensing for every app bought through that token.

MicrosoftView mobile applications such as store apps, line-of-business apps, web-links, or built-in apps. You can also view books purchased through the Apple Volume Purchase Program or add eBook categories. You can view iOS VPP Tokens, Windows Symantec certificates, Windows side loading keys, app categories, or the Android for Work connection. See the note following this table regarding Apple Volume Purchase Program (VPP) apps.

MicrosoftCreate relationships with other managed apps using Dependencies and Supersedence features.

In practiceSupersedence can uninstall the app it replaces, and dependencies install extra apps automatically. Relationships change what lands on devices without touching any assignment.

MicrosoftManage mobile applications such as store apps, line-of-business apps, web-links, or built-in apps. You can also manage books purchased through the Apple Volume Purchase Program or add eBook categories. You can manage iOS VPP Tokens, Windows Symantec certificates, Windows side loading keys, app categories, or the Android for Work connection. The Mobile Applications Create permission may be required for certain application update scenarios. See the note following this table regarding Apple Volume Purchase Program (VPP) apps.

In practiceSwapping the package or detection rules on an already-assigned app changes what installs on every targeted device.

Microsoft (via Graph)Generate, view, or export reports for applications, such as store apps, line-of-business apps, web-links, and built-in apps.

In practiceInstall status and app reports. Read-only, and a good fit for app owners who need to see results without changing anything.

MicrosoftAdd, remove, or modify the Mobile Threat Defense connectors between Intune and your chosen MTD vendors

In practiceMTD risk levels can drive compliance and Conditional Access. Removing a connector, or changing how unresponsive partners are treated, changes who gets access.

MicrosoftView the Mobile Threat Defense connectors between Intune and your chosen MTD vendors

MicrosoftApprove or reject approval requests for Multi Admin Approval configuration.

In practiceApprovers are the second person in the two-person rule. Never put the same people in both the requester and approver groups.

MicrosoftCreate access policies for Multi Admin Approval.

MicrosoftDelete access policies for Multi Admin Approval.

In practiceDeleting a policy removes the approval requirement for that resource type. It's the off switch for your two-person rule.

MicrosoftRead access policies for Multi Admin Approval.

MicrosoftUpdate access policies for Multi Admin Approval.

In practiceChanging the approver group changes who can say yes to protected changes.

MicrosoftAssign Operating System Recovery profiles.

In practiceRecovery settings decide how devices behave when they fail to start, so assign them with the same care as other device configuration.

MicrosoftCreate Operating System Recovery profiles.

In practiceNo effect until assigned.

MicrosoftDelete Operating System Recovery profiles.

MicrosoftRead Operating System Recovery profiles.

MicrosoftUpdate Operating System Recovery profiles.

In practiceChanges to an assigned profile reach its devices.

MicrosoftCreate tenant settings such as device categories and Exchange connectors.

MicrosoftDelete tenant settings such as device categories and Exchange Connectors.

In practiceDevice categories are often used for dynamic groups. Deleting one can change group membership and with it app and policy targeting.

MicrosoftView tenant settings such as device categories and Exchange Connectors. This permission is required to activate all enrollment workflows. Also allows viewing the Scoped permissions setting and running the Permissions Assessment Report.

In practiceMost enrollment-related roles need this one.

MicrosoftManage tenant settings, device categories, and Exchange Connectors. Also allows enabling the Scoped permissions setting.

In practiceTenant-wide by definition, and it includes turning on Scoped permissions, which changes how every RBAC assignment in the tenant is evaluated.

MicrosoftAssign organizational messages.

In practiceThese messages appear to users as coming from IT. In the wrong hands that's a phishing channel, so review messages before they're assigned.

MicrosoftCreate and assign organizational messages.

In practicePer Microsoft's description, Create also allows assigning, so Create alone is enough to send a message.

MicrosoftDelete organizational messages.

MicrosoftRead organizational messages.

MicrosoftCancel organizational messages.

In practiceDespite the name, Update means cancel.

MicrosoftEnable or block organizational messages directly from Microsoft, while allowing admin messages to display.

In practiceA tenant-wide switch for messages that come from Microsoft rather than your admins.

MicrosoftConfigure the Compliance Connector for Jamf.

In practiceJamf-managed Macs get their compliance state through this connector. Breaking it affects their Conditional Access.

MicrosoftView the Compliance Connector for Jamf.

MicrosoftAssign Policy Sets to Microsoft Entra security groups.

In practiceOne assignment deploys everything in the set: apps, configuration, compliance. It may be broader than the permissions you'd grant for each item separately.

MicrosoftCreate a new Policy Set.

MicrosoftDelete Policy Sets.

MicrosoftView Policy Sets.

MicrosoftChange a Policy Set, or add items to a Policy Set.

In practiceAdding an item to a set that's already assigned deploys that item to the set's groups.

MicrosoftAssign quiet time policies to Microsoft Entra security groups.

In practiceLow risk to devices, but a wide or wrongly timed assignment means people don't see work notifications when they expect to.

MicrosoftCreate new quiet time policies.

MicrosoftDelete quiet time policies.

MicrosoftView device quiet time policies.

MicrosoftChange quiet time policies.

In practiceChanges to an assigned policy change notification hours for everyone in scope.

MicrosoftView, generate, and export quiet time policy reports.

MicrosoftView the status of the TeamViewer connector and remote help. This permission isn't required to initiate remote assistance requests for devices.

MicrosoftManage the state of the TeamViewer connector and remote help. This permission also requires the Remote assistance connectors > Read permission to view the status of the TeamViewer connector and remote help.

In practiceThis is the tenant switch for remote control tools. Enabling a connector opens a remote-access path into user devices.

MicrosoftView, generate and export remote help sessions and monitor reports.

MicrosoftFor Windows devices, elevation allows the helper to enter UAC credentials when prompted on the sharer's device when remote help is enabled. Enabling elevation also allows the helper to view and control the sharer's device when the sharer grants the helper access.

In practiceThe helper can approve administrator prompts on the user's device, so they're effectively a local admin for the session.

MicrosoftTake full control allows the helper to view and control the sharer's device when Remote Help is enabled for all platforms we support.

MicrosoftAllows the helper to connect to Android devices without requiring the sharer to accept the connection each time. This capability requires the Android device to be enrolled in Intune as a dedicated device. Assign this permission explicitly and scope it to the specific devices that can receive unattended support.

In practiceNo one on the device has to say yes. Microsoft itself says to scope it tightly.

MicrosoftAllows the helper to start an unattended remote sign-in session to a targeted, physical, corporate-owned Windows device without requiring the sharer to accept the connection each time. Assign this permission explicitly and scope it to the specific devices that can receive unattended support.

In practiceRemote sign-in to a Windows PC with no user present to approve or watch. Grant it only to a named group, scoped to specific devices, ideally just-in-time.

MicrosoftView screen allows the helper to view the sharer's device when Remote Help is enabled for all platforms we support.

In practiceView-only, but helpers see whatever is on the screen, including email, chats, and documents.

MicrosoftRemove the Activation Lock from supervised devices without requiring the user's Apple ID and password. This may be required if a user leaves the company and returns the device; without the user's Apple ID and password, there's no way to reactivate the device. Or, you need to reassign some devices to a different department during a device refresh in your organization. You can only reassign devices that don't have Activation Lock enabled. You must also have the Managed Device > Read permission to view devices in the Azure portal before initiating this remote task.

In practiceActivation Lock is Apple's anti-theft protection. Bypassing it is right when reassigning a returned device, and also exactly what a thief would want.

Microsoft (via Graph)Cancel an in-progress enhanced log collection request on a device.

MicrosoftAllows IT Admin to initiate a change assignments action. Action allows the selection of assigned applications and configuration to be removed from a device. Additionally, previously removed applications and configuration to be restored on the device.

In practiceRemoves assigned apps and configuration from one device, including security configuration. It's a per-device exception that bypasses your group targeting.

Microsoft (via Graph)Move a Chrome Enterprise device to an existing organizational unit in your Google Workspace domain.

In practiceIn Google Workspace, the organizational unit decides which Chrome policies and apps a device gets. Moving a Chromebook to another OU changes its whole configuration.

MicrosoftInitiate a Fresh start device action. This action removes any apps that are installed on a Windows 10 PC that's running the Creators Update. Then, it automatically updates the PC to the latest version of Windows.

In practiceRemoves every installed app from the PC. The user can be offline for hours while it rebuilds.

MicrosoftCollect device diagnostics

In practiceUploads logs and diagnostic files from the device. Low risk, but diagnostics can contain user and system details, so treat the files as sensitive.

MicrosoftTurn off lost mode for an iOS or ChromeOS device.

MicrosoftInitiate lost mode on lost or stolen iOS or ChromeOS devices. This mode lets you enter a message and a phone number that appears on the lock screen of the device. To use lost mode, the device must be a corporate-owned iOS device that is in supervised mode.

In practiceLocks the device and shows your message until lost mode is turned off.

MicrosoftEnable Windows Intune agent.

MicrosoftGet Mac FileVault key.

In practiceThe FileVault recovery key decrypts that Mac's disk. It's included in the built-in Read Only Operator role, so check who has that role.

MicrosoftIndicates remote device action to initiate Mobile Device Management (MDM) attestation if device is capable for it.

In practiceAsks the device to prove its identity and integrity (for example, through the TPM) to Intune. A health check, low risk.

MicrosoftInitiate a remote action on a device managed by Configuration Manager.

In practiceWhat this can do depends on the Configuration Manager action selected, so treat it like the most powerful of them.

MicrosoftView the location of a lost or stolen corporate-owned device on a map. Can locate supervised iOS/iPadOS devices, Android dedicated devices (COSU), and Windows devices.

In practiceA device's location is usually a person's location. Use it for lost or stolen devices, and make sure your privacy policy and HR know it's possible.

MicrosoftSign out the user with the current session on a shared device. This action doesn't delete users from a shared device, it only forces the user with a current session to be logged out.

MicrosoftOffboard the devices associated with a user, when the user is leaving the organization.

In practiceActs on every device associated with the user at once. Confirm exactly what your offboarding flow does before granting it.

MicrosoftInitiate a remote assistance session with a user's device by using a remote assistance provider. The remote assistance option for your provider must be enabled for your tenant.

MicrosoftPlay a sound to locate lost Android dedicated devices, or iOS devices placed in MDM lost mode.

MicrosoftInitiates a device restart. This causes the device you choose to be restarted. The device owner isn't automatically notified of the restart, and they might lose work.

MicrosoftInitiate Mobile Device Management (MDM) certificate's private key recovery with TPM attestation

In practiceA repair action for the device's management certificate. Useful for support engineers, rarely needed day to day.

MicrosoftThe Remote lock device action locks the device. To unlock the device, the device owner enters their passcode. You can remotely lock devices that have a PIN or password set. Devices that don't have a PIN or password can't be remotely locked.

MicrosoftAllows admin to initiate removal of device from Device Firmware Configuration Interface management before deleting the Intune and Autopilot records.

In practiceDFCI locks down firmware settings like boot from USB. Removing it hands firmware control back to whoever has the device.

Microsoft (via Graph)Remove the data plan for cellular Android Enterprise devices that support eSIM.

In practiceThe device loses its cellular connection, and it may not be reachable for management again until it's on Wi-Fi.

MicrosoftInitiates a forced removal of the passcode, and requires the device user to set a new passcode. Supported on iOS devices, and certain later versions of Android and Android for work. Not supported on older Android versions, macOS, or Windows.

In practiceRemoves the passcode until the user sets a new one, so the device is unprotected in between. Verify who's asking before you use it.

MicrosoftManually restore Managed Home Screen on Android Enterprise devices to return them to kiosk mode from a temporarily suspended state. Complements the temporary suspend action for complete kiosk mode management.

MicrosoftInitiates a retire action for a device. Also called remove company data. The Remove company data action removes managed app data (where applicable), settings, and email profiles that were assigned by using Intune. The device is removed from Intune management. This happens the next time the device checks in and receives the remote Remove company data action. Remove company data leaves the user's personal data on the device. For ChromeOS devices, this starts a deprovision action.

In practicePersonal data stays, but the device leaves management and loses company apps, email, and settings.

MicrosoftRevokes any iOS VPP application licenses that have been associated with the device.

MicrosoftInitiates a key rotation for BitLocker Recovery Passwords on the device.

In practiceRotation is a security improvement: the old recovery password stops working. It doesn't reveal the new one.

MicrosoftRotate Mac FileVault key.

In practiceRotation invalidates the old recovery key, which is good hygiene after a key has been viewed.

MicrosoftInitiates a manual rotation for the local admin password on the device

In practiceRotates the Windows LAPS password. Low risk on its own, and a good habit after a password has been used.

MicrosoftRotate the recovery lock password for macOS devices

MicrosoftInitiate On Demand pause configuration refresh

In practicePauses Windows configuration refresh, which normally puts drifted settings back. Useful for troubleshooting, but while it's paused, local changes to managed settings stick.

MicrosoftInitiate On Demand Proactive Remediation

In practiceRuns a remediation script on the device right now. Script execution on demand is powerful even when the script itself was approved.

MicrosoftAllows admin to send customized notifications to devices. Devices receive notifications in Company Portal.

In practiceThe message comes from your trusted IT channel, which makes it ideal for phishing if misused.

MicrosoftSet or change the name of a device.

In practiceDevice names often drive dynamic groups, scripts, and naming conventions, so renames can have side effects.

MicrosoftInitiates a shutdown of the device, and will automatically close all applications and running services and leave the device in a powered-off state.

In practiceSomeone has to physically turn the device back on.

MicrosoftInitiates a sync operation on the device and forces the selected device to immediately check in with Intune. When a device checks in, it immediately receives any pending actions or policies that have been assigned to it.

In practiceSafe and useful. A great first permission for tier 1.

MicrosoftRemotely suspend Managed Home Screen on Android Enterprise devices in kiosk mode, allowing temporary access to the default launcher experience. Supports automatic restoration after a configured time period without requiring user interaction or PIN sharing.

In practiceTakes a kiosk device out of kiosk mode for a while, so whoever is holding it gets the normal launcher.

Microsoft (via Graph)Initiate enhanced log collection on a device to gather detailed diagnostic logs for troubleshooting.

In practiceMore detailed than Collect diagnostics, so the logs are more likely to contain user and system details. Treat the output as sensitive.

MicrosoftActivate the data plan for cellular iOS/iPadOS devices that support eSIM.

In practiceIn a live tenant (October 2026) this also covers Android Enterprise devices with eSIM.

MicrosoftAllows changing the device account associated with Surface Hub devices, and set authentication options such as password rotation.

MicrosoftView the recovery lock password in the Recovery Keys blade of macOS devices

In practiceRecovery Lock protects macOS Recovery, where someone could reinstall or wipe the Mac. The password is a key to that door.

MicrosoftInitiates a Windows Defender signature update.

In practiceSafe and helpful.

MicrosoftInitiates a wipe of the device. Also called a "factory reset." The Factory reset action restores a device to its factory default settings. The user data is kept or wiped depending on whether or not you choose the Retain enrollment state and user account checkbox. For ChromeOS devices, this starts either a wipe or a factory reset (Powerwash) action.

In practiceThe most destructive action in Intune. It's included in the built-in Help Desk Operator role, so check who has that role. Protect it with Multi Admin Approval.

MicrosoftAssign Intune built-in or custom roles to Microsoft Entra security groups

In practiceWhoever can assign roles can give anyone, including themselves, any permission on this page.

MicrosoftCreate new Intune custom roles. Built-in roles are created by Intune automatically.

In practiceOn its own, creating a role grants nothing. Combined with Assign or Update, it's full control.

MicrosoftDelete a custom Intune role. You can't delete built-in roles.

In practiceDeleting a role in use removes those admins' access immediately.

MicrosoftView permissions, role assignments, member groups, and scope groups for any built-in or custom Intune role.

In practiceRead-only, but it's a map of who can do what. Fine for auditors.

MicrosoftUpdate custom role permissions and role assignments for built-in or custom roles. Role assignments define the administrators and end user scope for the role.

In practiceEditing a role's permissions changes access for everyone assigned it, and editing an assignment changes who has it and over what. Protect with Multi Admin Approval.

MicrosoftAssign Security Baseline profiles to Microsoft Entra security groups.

In practiceBaselines contain hundreds of settings. Assigning one broadly without testing is a classic source of help desk tickets.

MicrosoftCreate new Security Baseline profiles.

In practiceNo effect until assigned.

MicrosoftDelete Security Baseline profiles.

In practiceRemoves that baseline's protection from every device it targeted.

MicrosoftView Security Baseline profiles or profiles reporting or Template reporting for all Security Baseline workspace.

MicrosoftUpdate Security Baseline profiles.

In practiceEdits to an assigned baseline reach every targeted device.

MicrosoftView security tasks.

MicrosoftUpdate security tasks.

In practiceLets IT accept, reject, or complete tasks from the security team, so this is the hand-off point between the two teams.

MicrosoftUpdate ServiceNow connection.

In practiceConnects your tenant to a ServiceNow instance with stored credentials. Integration owners only.

MicrosoftView incidents from ServiceNow.

In practiceShows ServiceNow incident details inside Intune. Incidents can contain personal information about users.

MicrosoftView settings and status of telecom expense partner connector. The telecom expense partner connector feature was deprecated and this permission is no longer supported after June 2025.

In practiceDeprecated. Remove it from custom roles.

MicrosoftModify or activate telecom expense management partner connector. The telecom expense partner connector feature is deprecated and this permission is no longer supported after June, 2025.

In practiceDeprecated. Remove it from custom roles.

MicrosoftView Tenant attached recommendations. Recommendations are methods to improve site health and device management experience.

MicrosoftAssign terms and conditions to Microsoft Entra security groups.

In practiceUsers in scope must accept the terms to continue, so a new assignment can interrupt enrollment.

MicrosoftCreate new terms and conditions.

MicrosoftDelete an existing terms and conditions.

In practiceYour record of who accepted what may matter for legal or compliance reasons. Check with legal before deleting.

MicrosoftView terms and conditions.

MicrosoftManage existing terms and conditions but not assignments.

In practiceChanging the text, and especially issuing a new version, can require every user to accept again.

MicrosoftAdd, remove, or modify the code-signing certificate used to distribute line-of-business apps to your managed Windows devices.

In practiceControl of a code-signing certificate means control over what your devices will trust and install as your company's software.

MicrosoftView the code-signing certificate used to distribute line-of-business apps to your managed Windows devices.