Intune - what permissions are missing wiping PC?

Question

Hello,

I am trying to wipe out the PC using graph API.

Request:

I am attaching my configuration in Azure (which was done based on:
https://learn.microsoft.com/en-us/graph/api/intune-devices-manageddevice-wipe?view=graph-rest-1.0&tabs=http

I am receiving the following: Forbidded error:

{"error":{"code":"Forbidden","message":"{\r\n "_version": 3,\r\n "Message": "User is not authorized to perform this operation - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: c484e189-6a1f-468f-805c-31c04f4ea604 - Url: https://fef.msub07.manage.microsoft.com/DeviceFE/StatelessDeviceFEService/deviceManagement/managedDevices('e1d8eb81-91a4-43ef-aff7-d8ab9c3e62d0')/microsoft.management.services.api.wipe?api-version=2024-06-14\",\r\n "CustomApiErrorPhrase": "",\r\n "RetryAfter": null,\r\n "ErrorSourceService": "",\r\n "HttpHeaders": "{}"\r\n}","innerError":{"date":"2025-05-21T08:51:53","request-id":"c484e189-6a1f-468f-805c-31c04f4ea604","client-request-id":"c484e189-6a1f-468f-805c-31c04f4ea604"}}}

Here are the screenshots:

What is still missing?

Answer 1

Your Graph permissions look correct — you already have:

DeviceManagementManagedDevices.PrivilegedOperations.All

However, since you're using Delegated permissions, the signed-in user must also have sufficient Intune RBAC rights to perform the wipe.

From your screenshot, the role assigned only includes:

• Managed devices → Read / Delete / Query

It does not show permission for Remote tasks → Wipe.

In Intune, wipe is a privileged remote action controlled by RBAC. Even with the correct Graph scope, the API call will return 403 if the user does not have wipe permission in Intune.

To test:

• You could temporarily assign yourself the Intune Administrator role(If you have ability)

Or update the custom role to include Managed devices → Remote tasks → Wipe

Also ensure scope tags allow access to the target device.

Since you're getting "User is not authorized", this points to Intune RBAC rather than missing Graph permissions.