> For the complete documentation index, see [llms.txt](https://docs.intuneassistant.cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.intuneassistant.cloud/security-and-compliance/needed-permissions.md).

# Needed Permissions

Intune Assistant

## Needed Permissions

Complete guide to configuring granular permissions for Intune Assistant users

## [Permissions Overview](#permissions-overview)

Learn how to configure the required permissions for Intune Assistant and how to set up granular permissions for users in your organization.

### [Required Graph API Permissions](#required-graph-api-permissions)

Intune Assistant requests Microsoft Graph API permissions in stages: a core set the first time you sign up, and a couple of extra permissions the first time you use a feature that needs them. If you see a consent prompt again after your initial setup, it's one of these additional feature requests — not a repeat of something you already granted.

#### Core permissions (requested when you sign up)

| Permission                                | Type           | Description                                           |
| ----------------------------------------- | -------------- | ----------------------------------------------------- |
| `Group.Read.All`                          | Delegated      | Read group memberships and properties                 |
| `GroupMember.Read.All`                    | Delegated      | Read group membership relationships                   |
| `User.ReadBasic.All`                      | Delegated      | Read basic user information like name and email       |
| `RoleManagement.Read.Directory`           | Delegated      | Read Microsoft Entra ID directory role assignments    |
| `AuditLog.Read.All`                       | Delegated      | Read Microsoft Entra ID and Intune audit logs         |
| `Directory.AccessAsUser.All`              | Delegated only | Access directory data on behalf of the signed-in user |
| `DeviceManagementConfiguration.Read.All`  | Delegated      | Read Intune configuration profiles and baselines      |
| `DeviceManagementScripts.Read.All`        | Delegated      | Read PowerShell and shell scripts                     |
| `DeviceManagementRBAC.Read.All`           | Delegated      | Read Intune role-based access control assignments     |
| `DeviceManagementApps.Read.All`           | Delegated      | Read managed applications and app configurations      |
| `DeviceManagementServiceConfig.Read.All`  | Delegated      | Read device management service configuration          |
| `DeviceManagementManagedDevices.Read.All` | Delegated      | Read managed device inventory                         |
| `Policy.Read.ConditionalAccess`           | Delegated      | Read Conditional Access policies                      |
| `ConfigurationMonitoring.ReadWrite.All`   | Delegated      | Create and manage configuration drift monitors        |

Mostly read-only

Most core permissions are read-only. Two exceptions: `Directory.AccessAsUser.All` lets Intune Assistant act on Microsoft Graph on your behalf using your own directory permissions, and `ConfigurationMonitoring.ReadWrite.All` is needed for Drift Monitoring, which is included free with every account.

#### Drift Monitoring permissions (requested the first time you set up a monitor)

Drift Monitoring is free and included with every account, but it needs two extra permissions the first time you configure a monitor, so it can create and manage the background service account that watches for configuration changes:

| Permission                        | Type      | Description                                                                |
| --------------------------------- | --------- | -------------------------------------------------------------------------- |
| `Application.ReadWrite.All`       | Delegated | Create and manage the background service account used for drift monitoring |
| `AppRoleAssignment.ReadWrite.All` | Delegated | Assign the permissions that background service account needs to operate    |

#### Assignments Manager permissions (requested if you purchase this module)

Assignments Manager needs write access to manage and migrate policy assignments, in addition to the core permissions above:

| Permission                                    | Type      | Description                                               |
| --------------------------------------------- | --------- | --------------------------------------------------------- |
| `DeviceManagementConfiguration.ReadWrite.All` | Delegated | Create, update, and migrate Intune configuration profiles |
| `DeviceManagementApps.ReadWrite.All`          | Delegated | Create, update, and migrate app assignments               |
| `DeviceManagementServiceConfig.ReadWrite.All` | Delegated | Update device management service configuration            |
| `DeviceManagementScripts.ReadWrite.All`       | Delegated | Create, update, and migrate PowerShell and shell scripts  |
| `DeviceManagementRBAC.ReadWrite.All`          | Delegated | Update Intune role-based access control assignments       |

### [Configuring Granular User Permissions](#configuring-granular-user-permissions)

Instead of giving users full Intune Administrator permissions, you can configure granular role-based access control (RBAC) permissions. This follows the principle of least privilege.

#### [Understanding Intune RBAC](#understanding-intune-rbac)

Microsoft Intune uses role-based access control to determine what actions users can perform. Each role contains:

* **Permissions**: What actions can be performed
* **Scope**: Which resources the role applies to
* **Assignments**: Which users or groups have the role

#### [Required Intune Roles for Intune Assistant](#required-intune-roles-for-intune-assistant)

Since Intune Assistant only reads data, users need roles with **read permissions** for the following categories:

[**Device Configuration Reader**](#device-configuration-reader)

Allows reading device configuration profiles and compliance policies.

**Required permissions:**

* Device configuration policies: **Read**
* Device compliance policies: **Read**
* Device enrollment: **Read**

[**Application Reader**](#application-reader)

Allows reading application management data.

**Required permissions:**

* Mobile applications: **Read**
* Mobile application management policies: **Read**

[**Reports Reader**](#reports-reader)

Allows reading reports and analytics data.

**Required permissions:**

* Reports: **Read**

[**Conditional Access Reader**](#conditional-access-reader)

Allows reading Conditional Access policies.

**Required permissions:**

* Conditional Access: **Read**

#### [Creating a Custom Role](#creating-a-custom-role)

For optimal security, create a custom role with only the required read permissions:

{% stepper %}
{% step %}

### Navigate to Microsoft Intune admin center

* Go to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431)
* Select **Tenant administration** > **Roles** > **All roles**
  {% endstep %}

{% step %}

### Create new role

* Click **Create**
* Enter role name: `Intune Assistant Reader`
* Add description: `Read-only access for Intune Assistant users`
  {% endstep %}

{% step %}

### Configure permissions

* **Device configuration policies**: Read ✓
* **Device compliance policies**: Read ✓
* **Device enrollment**: Read ✓
* **Mobile applications**: Read ✓
* **Mobile application management policies**: Read ✓
* **Reports**: Read ✓
* **Organization**: Read ✓
  {% endstep %}

{% step %}

### Set scope and assignments

* Define which users/groups should have this role
* Set appropriate scope tags if needed
  {% endstep %}
  {% endstepper %}

#### [Built-in Roles Alternative](#built-in-roles-alternative)

If you prefer using built-in roles, assign users to:

* **Intune Service Administrator** (full read/write - not recommended)
* **Reports Reader** (limited to reports only)
* **Global Reader** (read access across Microsoft 365)

Recommended approach

We recommend creating a custom role with only the required read permissions to follow the principle of least privilege.

### [Troubleshooting](#troubleshooting)

Common permission issues:

| Issue                         | Solution                                                   |
| ----------------------------- | ---------------------------------------------------------- |
| User cannot see any data      | Check if user has required Intune role assigned            |
| Missing device configurations | Verify `DeviceManagementConfiguration.Read.All` permission |
| Missing applications          | Check `DeviceManagementApps.Read.All` permission           |

### [Consent missing](#consent-missing)

Intune Assistant requires admin consent for the Graph API permissions. Ensure that a Global Administrator has granted consent for the application in your tenant. New features may require additional permissions, if a required consent is missing you will get notified in the right bottom corner. (see the screenshot below) Then run the consent again.

For information about that process, check the [Managing Admin Consent](broken://pages/3285781e772e72eb9ead78862e26a5bfe729c13e) documentation.

### [Additional Resources](#additional-resources)

* [Microsoft Intune RBAC Reference](https://learn.microsoft.com/en-us/intune/fundamentals/role-based-access-control-reference)
* [Create custom roles in Intune](https://learn.microsoft.com/en-us/intune/fundamentals/create-custom-role)
* [Scope tags for distributed IT](https://learn.microsoft.com/en-us/intune/fundamentals/scope-tags)

Best practice

Regularly review and audit user permissions to ensure they align with current job responsibilities and security requirements.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.intuneassistant.cloud/security-and-compliance/needed-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.