Built-in role permissions for Microsoft Intune
The following tables lists the built-in roles for Microsoft Intune. The tables also list the permissions that are associated with each role.
Note
This article was partially created with the help of artificial intelligence. Before publishing, an author reviewed and revised the content as needed. See Our principles for using AI-generated content in Microsoft Learn.
Application Manager
Application Managers manage mobile and managed applications, can read device information and can view device configuration profiles.
| Permission | Action |
|---|---|
| Android for work | Read |
| Android for work | Update app sync |
| Filters | Create |
| Filters | Delete |
| Filters | Read |
| Filters | Update |
| Certificate Connector | Read |
| Cloud attached devices | Take application actions |
| Cloud attached devices | View applications |
| Cloud attached devices | View client details |
| Cloud attached devices | View collections |
| Cloud attached devices | View resource explorer |
| Cloud attached devices | View software updates |
| Cloud attached devices | View timeline |
| Customization | Read |
| Derived Credentials | Read |
| Device configurations | Read |
| Managed apps | Assign |
| Managed apps | Create |
| Managed apps | Delete |
| Managed apps | Read |
| Managed apps | Update |
| Managed apps | Wipe |
| Managed devices | Read |
| Microsoft Defender ATP | Read |
| Microsoft Store For Business | Read |
| Mobile apps | Assign |
| Mobile apps | Create |
| Mobile apps | Delete |
| Mobile apps | Read |
| Mobile apps | Relate |
| Mobile apps | Update |
| Mobile Threat Defense | Read |
| Organization | Read |
| Partner Device Management | Read |
| Policy Sets | Assign |
| Policy Sets | Create |
| Policy Sets | Delete |
| Policy Sets | Read |
| Policy Sets | Update |
| Windows Enterprise Certificate | Read |
Endpoint Security Manager
Manages security and compliance features such as security baselines, device compliance, conditional access, and Microsoft Defender ATP.
| Permission | Action |
|---|---|
| Android FOTA | Read |
| Android for work | Read |
| App Control for Business | Assign - (Added with the 2406 service release) |
| App Control for Business | Create - (Added with the 2406 service release) |
| App Control for Business | Delete - (Added with the 2406 service release) |
| App Control for Business | Read - (Added with the 2406 service release) |
| App Control for Business | Update - (Added with the 2406 service release) |
| App Control for Business | View reports - (Added with the 2406 service release) |
| Attack surface reduction | Assign - (Added with the 2406 service release) |
| Attack surface reduction | Create - (Added with the 2406 service release) |
| Attack surface reduction | Delete - (Added with the 2406 service release) |
| Attack surface reduction | Read - (Added with the 2406 service release) |
| Attack surface reduction | Update - (Added with the 2406 service release) |
| Attack surface reduction | View reports - (Added with the 2406 service release) |
| Audit data | Read |
| Certificate Connector | Read |
| Cloud attached devices | View client details |
| Cloud attached devices | Run CMPivot query |
| Cloud attached devices | View collections |
| Cloud attached devices | View resource explorer |
| Cloud attached devices | View scripts |
| Cloud attached devices | View software updates |
| Cloud attached devices | View timeline |
| Corporate device identifiers | Read |
| Customization | Read |
| Derived Credentials | Read |
| Device compliance policies | Assign |
| Device compliance policies | Create |
| Device compliance policies | Delete |
| Device compliance policies | Read |
| Device compliance policies | Update |
| Device compliance policies | View reports |
| Device configurations | Read |
| Device configurations | View reports |
| Device enrollment managers | Read |
| Endpoint Analytics | Read |
| Endpoint protection reports | Read |
| Enrollment programs | Read token |
| Endpoint detection and response | Assign - (Added with the 2406 service release) |
| Endpoint detection and response | Create - (Added with the 2406 service release) |
| Endpoint detection and response | Delete - (Added with the 2406 service release) |
| Endpoint detection and response | Read - (Added with the 2406 service release) |
| Endpoint detection and response | Update - (Added with the 2406 service release) |
| Endpoint detection and response | View reports - (Added with the 2406 service release) |
| Endpoint Privilege Management Policy Authoring | Assign |
| Endpoint Privilege Management Policy Authoring | Create |
| Endpoint Privilege Management Policy Authoring | Delete |
| Endpoint Privilege Management Policy Authoring | Read |
| Endpoint Privilege Management Policy Authoring | Update |
| Endpoint Privilege Management Policy Authoring | View reports |
| Enrollment programs | Read device |
| Enrollment programs | Read profile |
| Filters | Read |
| Intune data warehouse | Read |
| Managed apps | Read |
| Managed devices | Delete |
| Managed devices | Read |
| Managed devices | Set primary user |
| Managed devices | Update |
| Managed devices | View reports |
| Managed devices | Query |
| Microsoft Defender ATP | Read |
| Microsoft Store For Business | Read |
| Mobile apps | Read |
| Mobile Threat Defense | Modify |
| Mobile Threat Defense | Read |
| Organization | Read |
| Partner Device Management | Read |
| Policy Sets | Read |
| Remote assistance connectors | Read |
| Remote assistance connectors | View reports |
| Remote tasks | Initiate Configuration Manager action |
| Remote tasks | Get filevault key. |
| Remote tasks | Reboot now |
| Remote tasks | Remote lock |
| Remote tasks | Rotate BitLockerKeys (preview) |
| Remote tasks | Rotate filevault key. |
| Remote tasks | Shut down |
| Remote tasks | Sync devices. |
| Remote tasks | Windows defender |
| Roles | Read |
| Security baselines | Assign |
| Security baselines | Create |
| Security baselines | Delete |
| Security baselines | Read |
| Security baselines | Update |
| Security baselines | View reports |
| Security tasks | Read |
| Security tasks | Update |
| Telecom expenses | Read |
| Terms and conditions | Read |
| Windows Enterprise Certificate | Read |
Endpoint Privilege Manager
Endpoint Privilege Managers can manage Endpoint Privilege Management (EPM) policies in the Intune console.
| Permission | Action |
|---|---|
| Endpoint Privilege Management Policy Authoring | Assign |
| Endpoint Privilege Management Policy Authoring | Create |
| Endpoint Privilege Management Policy Authoring | Delete |
| Endpoint Privilege Management Policy Authoring | Read |
| Endpoint Privilege Management Policy Authoring | Update |
| Endpoint Privilege Management Policy Authoring | View reports |
| Organization | Read |
Read Only Operator
Read Only Operators view user, device, enrollment, configuration and application information and cannot make changes to Intune.
| Permission | Action |
|---|---|
| Android FOTA | Read |
| Android for work | Read |
| App Control for Business | Read - (Added with the 2406 service release) |
| Attack surface reduction | Read - (Added with the 2406 service release) |
| Audit data | Read |
| Certificate Connector | Read |
| Cloud attached devices | View applications |
| Cloud attached devices | View client details |
| Cloud attached devices | View collections |
| Cloud attached devices | View resource explorer |
| Cloud attached devices | View scripts |
| Cloud attached devices | View software updates |
| Cloud attached devices | View timeline |
| Corporate device identifiers | Read |
| Customization | Read |
| Derived Credentials | Read |
| Device compliance policies | Read |
| Device compliance policies | View reports |
| Device configurations | Read |
| Device configurations | View reports |
| Device enrollment managers | Read |
| Endpoint Analytics | Read |
| Endpoint detection and response | Read - (Added with the 2406 service release) |
| Endpoint Privilege Management Policy Authoring | Read |
| Endpoint Privilege Management Policy Authoring | View reports |
| Endpoint protection reports | Read |
| Enrollment programs | Read device |
| Enrollment programs | Read profile |
| Enrollment programs | Read token |
| Filters | Read |
| Managed apps | Read |
| Managed devices | Read |
| Managed devices | View reports |
| Microsoft Defender ATP | Read |
| Microsoft Store For Business | Read |
| Mobile apps | Read |
| Mobile Threat Defense | Read |
| Organization | Read |
| Organizational Messages | Read |
| Partner Device Management | Read |
| Policy Sets | Read |
| Quiet Time policies | Read |
| Quiet Time policies | View reports |
| Remote assistance connectors | Read |
| Remote assistance connectors | View reports |
| Remote tasks | Get filevault key. |
| Intune data warehouse | Read |
| Roles | Read |
| Security baselines | Read |
| ServiceNow | View Incidents |
| Telecom expenses | Read |
| Terms and conditions | Read |
| Windows Enterprise Certificate | Read |
Organizational Messages Manager
Organizational Messages Managers can manage organizational messages in Intune console.
| Permission | Action |
|---|---|
| Organization | Read |
| Organizational Messages | Assign |
| Organizational Messages | Create |
| Organizational Messages | Delete |
| Organizational Messages | Read |
| Organizational Messages | Update |
| Organizational Messages | Update organizational message control |
School Administrator
School Administrators can manage apps and settings for their groups. They can take remote actions on devices, including remotely locking them, restarting them, and retiring them from management.
| Permission | Action |
|---|---|
| Audit data | Read |
| Certificate Connector | Modify |
| Certificate Connector | Read |
| Cloud attached devices | Take application actions |
| Cloud attached devices | View applications |
| Cloud attached devices | View client details |
| Cloud attached devices | Run CMPivot query |
| Cloud attached devices | View collections |
| Cloud attached devices | Enroll Now |
| Cloud attached devices | View resource explorer |
| Cloud attached devices | Run script |
| Cloud attached devices | View scripts |
| Cloud attached devices | View software updates |
| Cloud attached devices | View timeline |
| Customization | Assign |
| Customization | Create |
| Customization | Delete |
| Customization | Read |
| Customization | Update |
| Derived Credentials | Read |
| Device configurations | Assign |
| Device configurations | Create |
| Device configurations | Delete |
| Device configurations | Read |
| Device configurations | Update |
| Device enrollment managers | Read |
| Device enrollment managers | Update |
| Endpoint Analytics | Create |
| Endpoint Analytics | Delete |
| Endpoint Analytics | Read |
| Endpoint Analytics | Update |
| Enrollment programs | Assign profile |
| Enrollment programs | Create profile |
| Enrollment programs | Delete device |
| Enrollment programs | Delete profile |
| Enrollment programs | Read device |
| Enrollment programs | Read profile |
| Enrollment programs | Sync device |
| Enrollment programs | Update profile |
| Filters | Create |
| Filters | Delete |
| Filters | Read |
| Filters | Update |
| Enrollment programs | Create token |
| Enrollment programs | Delete token |
| Enrollment programs | Read token |
| Enrollment programs | Update token |
| Managed apps | Create |
| Managed apps | Delete |
| Managed apps | Read |
| Managed apps | Update |
| Managed devices | Delete |
| Managed devices | Read |
| Managed devices | Set primary user |
| Managed devices | Update |
| Microsoft Defender ATP | Read |
| Microsoft Store For Business | Modify |
| Microsoft Store For Business | Read |
| Mobile apps | Assign |
| Mobile apps | Create |
| Mobile apps | Delete |
| Mobile apps | Read |
| Mobile apps | Relate |
| Mobile apps | Update |
| Mobile Threat Defense | Read |
| Organization | Read |
| Partner Device Management | Read |
| Policy Sets | Assign |
| Policy Sets | Create |
| Policy Sets | Delete |
| Policy Sets | Read |
| Policy Sets | Update |
| Remote assistance connectors | Read |
| Remote assistance connectors | Update |
| Remote assistance connectors | View reports |
| Remote Help app | Elevation |
| Remote Help app | Take full control |
| Remote Help app | View screen |
| Remote tasks | Update cellular data plan |
| Remote tasks | Clean PC |
| Remote tasks | Initiate Configuration Manager action |
| Remote tasks | Collect diagnostics |
| Remote tasks | Disable lost mode |
| Remote tasks | Enable lost mode |
| Remote tasks | Recover MDM Key |
| Remote tasks | Locate device |
| Remote tasks | Run Remediation |
| Remote tasks | Play sound to locate lost devices |
| Remote tasks | Reboot now |
| Remote tasks | Remote lock |
| Remote tasks | Offer remote assistance |
| Remote tasks | Reset passcode |
| Remote tasks | Retire |
| Remote tasks | Set device name |
| Remote tasks | Sync devices. |
| Remote tasks | Wipe |
| Intune data warehouse | Read |
| ServiceNow | View Incidents |
| Terms and conditions | Assign |
| Terms and conditions | Create |
| Terms and conditions | Delete |
| Terms and conditions | Read |
| Terms and conditions | Update |
| Windows Enterprise Certificate | Modify |
| Windows Enterprise Certificate | Read |
Policy and Profile manager
Policy and Profile Managers manage compliance policy, configuration profiles, Apple enrollment and corporate device identifiers.
| Permission | Action |
|---|---|
| Android FOTA | Read |
| Android for work | Read |
| Android for work | Update app sync |
| Android for work | Update onboarding |
| Audit data | Read |
| Certificate Connector | Read |
| Cloud attached devices | View applications |
| Cloud attached devices | View client details |
| Cloud attached devices | View collections |
| Cloud attached devices | View resource explorer |
| Cloud attached devices | View scripts |
| Cloud attached devices | View software updates |
| Cloud attached devices | View timeline |
| Corporate device identifiers | Create |
| Corporate device identifiers | Delete |
| Corporate device identifiers | Read |
| Corporate device identifiers | Update |
| Derived Credentials | Read |
| Device compliance policies | Assign |
| Device compliance policies | Create |
| Device compliance policies | Delete |
| Device compliance policies | Read |
| Device compliance policies | Update |
| Device compliance policies | View reports |
| Device configurations | Assign |
| Device configurations | Create |
| Device configurations | Delete |
| Device configurations | Read |
| Device configurations | Update |
| Device configurations | View reports |
| Enrollment programs | Assign profile |
| Enrollment programs | Create device |
| Enrollment programs | Create token |
| Enrollment programs | Create profile |
| Enrollment programs | Delete device |
| Enrollment programs | Delete profile |
| Enrollment programs | Delete token |
| Enrollment programs | Read device |
| Enrollment programs | Read token |
| Enrollment programs | Read profile |
| Enrollment programs | Sync device |
| Enrollment programs | Update token |
| Enrollment programs | Update profile |
| Filters | Create |
| Filters | Delete |
| Filters | Read |
| Filters | Update |
| Managed apps | Assign |
| Managed apps | Create |
| Managed apps | Delete |
| Managed apps | Read |
| Managed apps | Update |
| Microsoft Defender ATP | Read |
| Mobile Threat Defense | Read |
| Organization | Read |
| Partner Device Management | Read |
| Policy Sets | Assign |
| Policy Sets | Create |
| Policy Sets | Delete |
| Policy Sets | Read |
| Policy Sets | Update |
| Quiet Time policies | Assign |
| Quiet Time policies | Create |
| Quiet Time policies | Delete |
| Quiet Time policies | Read |
| Quiet Time policies | Update |
| Quiet Time policies | View reports |
Help Desk Operator
Help Desk Operators perform remote tasks on users and devices and can assign applications or policies to users or devices.
| Permission | Action |
|---|---|
| Android FOTA | Read |
| Android for work | Read |
| App Control for Business | Read - (Added with the 2406 service release) |
| Attack surface reduction | Read - (Added with the 2406 service release) |
| Audit data | Read |
| Certificate Connector | Read |
| Cloud attached devices | Take application actions |
| Cloud attached devices | View applications |
| Cloud attached devices | View client details |
| Cloud attached devices | Run CMPivot query |
| Cloud attached devices | View collections |
| Cloud attached devices | Enroll Now |
| Cloud attached devices | View resource explorer |
| Cloud attached devices | Run script |
| Cloud attached devices | View scripts |
| Cloud attached devices | View software updates |
| Cloud attached devices | View timeline |
| Corporate device identifiers | Read |
| Customization | Read |
| Derived Credentials | Read |
| Device compliance policies | Read |
| Device compliance policies | View reports |
| Device configurations | Read |
| Device configurations | View reports |
| Device enrollment managers | Read |
| Endpoint Analytics | Read |
| Endpoint detection and response | Read - (Added with the 2406 service release) |
| Endpoint protection reports | Read |
| Enrollment programs | Read device |
| Enrollment programs | Read profile |
| Enrollment programs | Read token |
| Filters | Read |
| Managed apps | Assign |
| Managed apps | Read |
| Managed apps | Wipe |
| Managed devices | Read |
| Managed devices | Set primary user |
| Managed devices | Update |
| Managed devices | View reports |
| Microsoft Defender ATP | Read |
| Microsoft Store For Business | Read |
| Mobile apps | Assign |
| Mobile apps | Read |
| Mobile Threat Defense | Read |
| Organization | Read |
| Partner Device Management | Read |
| Policy Sets | Read |
| Remote assistance connectors | Read |
| Remote Help app | Elevation |
| Remote Help app | Take full control |
| Remote Help app | View screen |
| Remote tasks | Update cellular data plan |
| Remote tasks | Clean PC |
| Remote tasks | Initiate Configuration Manager action |
| Remote tasks | Send custom notifications |
| Remote tasks | Collect diagnostics |
| Remote tasks | Disable lost mode |
| Remote tasks | Enable lost mode |
| Remote tasks | Enable Windows IntuneAgent |
| Remote tasks | Get filevault key. |
| Remote tasks | Recover MDM Key |
| Remote tasks | Locate device |
| Remote tasks | Manage shared device users |
| Remote tasks | Run Remediation |
| Remote tasks | Play sound to locate lost devices |
| Remote tasks | Reboot now |
| Remote tasks | Remote lock |
| Remote tasks | Offer remote assistance |
| Remote tasks | Reset passcode |
| Remote tasks | Retire |
| Remote tasks | Revoke App Licenses |
| Remote tasks | Rotate BitLockerKeys (preview) |
| Remote tasks | Rotate filevault key. |
| Remote tasks | Set device name |
| Remote tasks | Shut down |
| Remote tasks | Sync devices. |
| Remote tasks | Update device account |
| Remote tasks | Windows defender |
| Remote tasks | Wipe |
| Roles | Read |
| Security baselines | Read |
| ServiceNow | View Incidents |
| Telecom expenses | Read |
| Terms and conditions | Read |
| Windows Enterprise Certificate | Read |
Endpoint Privilege Reader
Organizational Messages Readers can view Endpoint Privilege Management (EPM) policies in the Intune console.
| Permission | Action |
|---|---|
| Endpoint Privilege Management Policy Authoring | Read |
| Endpoint Privilege Management Policy Authoring | View reports |
| Organization | Read |
Intune Role Administrator
Intune Role Administrators manage custom Intune roles and add assignments for built-in Intune roles. It is the only Intune role that can assign permissions to Administrators.
| Permission | Action |
|---|---|
| Organization | Read |
| Roles | Assign |
| Roles | Create |
| Roles | Delete |
| Roles | Read |
| Roles | Update |