☁️
CTHFM: Azure
  • Welcome
  • Getting Started
    • Account Setup
      • Account Creation Instructions
  • Azure Fundamentals
    • Azure Fundamentals Overview
      • Azure Documentation
      • Azure Entra
      • Azure Hierarchy
      • Identities
      • Azure Entra Roles
      • Azure RBAC
      • Azure Licensing Overview
        • Azure Entra ID Premium Licenses Comparison
      • Azure Shared Responsibility Model
      • Azure Frameworks
      • Azure Security Services
      • Conditional Access Policies
        • How Conditional Access Policies Work
        • Benefits of Conditional Access
        • Best Practices for Conditional Access
        • Conditions for Conditional Access
        • Conditional Access Controls
        • Sign-In Risk and Identity Protection
        • Conditional Access Session Control
        • Name Locations IP Location
      • Azure Quotas
      • Azure Tokens
        • Access Tokens
        • ID Tokens
        • Refresh Tokens
          • Invalidate Refresh Tokens
        • Primary Refresh Tokens
        • Continuous Access Evaluation (CAE)
        • Token Protection: Conditional Access (Public Preview)
  • Azure CLI
    • Introduction to Azure CLI
    • Installing Azure CLI
    • CLI Commands
    • Resource Group Management
    • Creating and Managing Resources with Azure CLI
    • Managing IAM
    • Azure CLI Automation
    • Monitoring and Troubleshooting in Azure CLI
    • Azure CLI Overview
      • Azure CLI: Linux
      • Azure CLI: Windows
      • Azure CLI: MacOS
  • KQL
    • KQL Overview
      • KQL Introduction
      • Data Types
      • Quick Reference
      • Render
      • Basic Queries
  • Powershell
    • PowerShell for Azure
      • Powershell Documentation
      • Powershell Basics
      • Understanding Powershell Variables
      • Understanding Cmdlets
      • Powershell Console & ISE
      • Powershell: Entra Module
        • Module Reference & Getting Started
      • Powershell: Azure Module
        • Installation Instructions
        • Powershell Azure CLI: Windows
        • Powershell Azure CLI: Linux
        • Powershell Azure CLI: MacOS
        • Example Azure Cmdlets
  • Bicep
    • Bicep File Structure
    • Variable Types
  • Azure Logging References
    • Logging
      • Log Retention Strategies
      • Azure Log Types
      • Azure Activity Logs
        • Administrative Event Schema
        • Service Health Notification Schema
        • Resource Health
        • Alert Category
        • Autoscale
        • Security
        • Recommendation
        • Policy
      • Entra ID Logging
        • Identity Based Logs
          • Audit Logs
          • Sign-In Logs
            • AADNonInteractiveUserSignInLogs
            • AADManagedIdentitySignInLogs
            • AADServicePrincipalSignInLogs
            • First Party Sign-In Activity
          • Provisioning Logs (AADProvisioningLogs)
          • Microsoft Graph Activity
          • Identity Protection
            • Risk Detections
            • AADRiskyServicePrincipals
            • AADRiskyUsers
            • AADUserRiskEvents
            • AADServicePrincipalRiskEvents
        • Additional Entra ID Logs
      • Azure Key Vault
        • Azure Key Vault Logging Overview
      • Network Watcher
        • RBAC Permissions
        • Flow Log Types
          • NSG Flow Log Schema
          • VNET Flow Log Schema
        • Enabling Logs
          • NSG Flow Logs
          • VNET Flow Logs
        • Packet Capture
          • Packet Capture: VM
          • Packet Capture: Scale Sets
      • Compute Resources
        • Azure Monitor Agent
        • VM Insights
          • VM Insights Tables
      • Storage Accounts
        • Storage Account Logging
          • File
            • Enable StorageFileLogs
            • StorageFileLogs
          • Blob
            • Enable Blob Logging
            • StorageBlobLogs
          • Queue
            • Enable Queue Logging
            • StorageQueueLogs Table
          • Table
            • Enable Table Logging
            • StorageTableLogs Table
      • Azure App Service
        • Log Types
        • Enabling Logging
      • Azure Monitor
        • Resource Logs
          • Resource Log Top Level Documentation
        • Log Analytics Workspace
          • Setup
        • Workbooks
        • Dashboards
        • Alerts
        • Azure Monitor Documentation
      • Defender for Cloud
      • Intune
      • Sysmon
      • Purview Audit Log Schema
      • Kubernetes Audit Log (AKS)
  • Threat Hunting
    • Threat Hunting in Azure
      • Threat Hunting Introduction
      • Threat Hunting Process
        • Hypothesis Generation
        • Investigation
        • Identification
        • Resolution & Follow Up
      • Pyramid of Pain
      • Azure Threat Hunting Ideas
      • Hands On Threat Hunting Examples
      • OSINT Feeds
  • Sigma
    • Sigma Rule Structure
  • Microsoft Defender TI
    • Microsoft Defender Threat Intelligence
      • Data Sets
      • Reputational Scoring
      • Analyst Insights
      • Microsoft Defender TI: Copilot Integration
  • MITRE Att&ck
    • MITRE Att&ck
      • MITRE Att&ck Concepts
      • MITRE Data Sources
      • MITRE Att&ck Mitigations
      • MITRE Att&ck: Azure
        • MITRE Att&CK: Azure Security Control Mapping
  • Microsoft Resources
    • Microsoft Incident Response Ninja Hub
    • Microsoft Defender XDR Ninja Hub
  • Azure Threat Research Matrix (ATRM)
  • Security Research & Resources
    • Azure Goat
    • Azure Security Research
      • Azure Related CVEs
  • Defender XDR
    • Defender XDR Overview
    • Defender XDR Licensing
    • Defender XDR Default Retention
    • Defender XDR Advanced Hunting Table Schemas
    • Automated Response Requirements
    • Supported Response Actions
  • Azure Sentinel
    • Sentinel Overview
    • Azure Sentinel Deployments
    • Supported Data
    • Workbook, Playbook, Notebook Comparison
    • Sentinel Workbooks
    • Entities
    • User and Entity Behavior Analytics
    • Anomaly Detection
    • Mult-Stage Attack Detection
    • Sentinel: Az CLI
  • Microsoft Defender
    • Microsoft Defender for Cloud References
    • Defender for Cloud: Az CLI
  • Azure Policy
    • Azure Policy
    • Azure Policy Components
    • Azure Policy Rules
    • Scope Azure Policy
    • Policy Assignments
    • Policy Effect
    • Initiative Definition
    • Policy Parameters
    • Remediation Task Structure
    • Use Cases for Azure Policy
    • Azure Policy: Az CLI
  • Intune
    • Intune Overview
    • Intune Licensing
    • Intune API Permission Scopes
    • Intune Sample Script Resources
  • Intune Logging
    • Configure Logging
    • Logging Schema References
    • Intune Queries and Resources
  • Windows Host Security
    • Windows System Architecture and OS Fundamentals
    • SysInternals
    • Basic vs Advanced Security Auditing
    • Sysmon
  • Adversary Emulation
    • AzureHound
    • AADInternals
      • Install
    • RoadTools
      • Install
    • Oh365UserFinder
    • GraphRunner
  • Incident Response
    • Incident Response
      • Azure IR Program Development Cheat Sheet
      • Azure IR Playbooks (MS Guidance)
      • Ransomware (MS Guidance)
  • Automation
    • Automation Overview
    • Logic Apps
      • How Logic Apps Work
      • Logic App Types
      • Triggers
      • Connectors
      • Conditional Logic and Control Flow
      • APIs in Logic Apps
      • Handling Large Workflows with Stateful Logic Apps
      • External Service Integration
      • Securing, Managing, and Scaling Azure Logic Apps
      • Logic Apps: Az CLI
  • Packet Analysis
    • Wireshark Cheatsheet
    • TShark Cheatsheet
    • TCPDUMP Cheatsheet
    • Protocol Analysis Basics
    • HTTP Response Code Cheatsheet
    • RFC Protocol Mappings
    • PCAP Acquisition
  • Detection Lab
    • Detection Lab Introduction
    • Account Creation Instructions
    • Enable MFA Within Azure Tenant
    • Create an Azure Admin With Cloud Shell
    • Setup and Install Instructions
  • VSCode and Code Setup
  • Deploying Code
  • Enabling Logs for Log Analytics Workspace
  • Logging Into Windows VM
  • Verifying Logs in Log Analytics Workspace
  • Creating Detections: Azure Monitor
  • Cost Management: Billing Alarms
Powered by GitBook
On this page
  • Intune permission scopes
  • DeviceManagementApps.Read.All
  • DeviceManagementApps.ReadWrite.All
  • DeviceManagementConfiguration.Read.All
  • DeviceManagementConfiguration.ReadWrite.All
  • DeviceManagementManagedDevices.PrivilegedOperations.All
  • DeviceManagementManagedDevices.Read.All
  • DeviceManagementManagedDevices.ReadWrite.All
  • DeviceManagementRBAC.Read.All
  • DeviceManagementRBAC.ReadWrite.All
  • DeviceManagementServiceConfig.Read.All
  • DeviceManagementServiceConfig.ReadWrite.All
  • Reference
  1. Intune

Intune API Permission Scopes

Last updated 8 months ago

Intune permission scopes

Microsoft Entra ID and Microsoft Graph use permission scopes to control access to corporate resources.

Permission scopes (also called the OAuth scopes) control access to specific Intune entities and their properties. This section summarizes the permission scopes for Intune API features.

To learn more:

When you grant permission to Microsoft Graph, you can specify the following scopes to control access to Intune features: The following table summarizes the Intune API permission scopes. The first column shows the name of the feature as displayed in the and the second column provides the permission scope name.

Expand table

Enable Access setting

Scope name

Perform user-impacting remote actions on Microsoft Intune devices

Read and write Microsoft Intune devices

Read Microsoft Intune devices

Read and write Microsoft Intune RBAC settings

Read Microsoft Intune RBAC settings

DeviceManagementRBAC.Read.All

Read and write Microsoft Intune apps

Read Microsoft Intune apps

Read and write Microsoft Intune Device Configuration and Policies

DeviceManagementConfiguration.ReadWrite.All

Read Microsoft Intune Device Configuration and Policies

Read and write Microsoft Intune configuration

Read Microsoft Intune configuration

DeviceManagementServiceConfig.Read.All

At this time, all Intune permission scopes require administrator access. This means you need corresponding credentials when running apps or scripts that access Intune API resources.

DeviceManagementApps.Read.All

  • Enable Access setting: Read Microsoft Intune apps

  • Permits read access to the following entity properties and status:

    • Client Apps

    • Mobile App Categories

    • App Protection Policies

    • App Configurations

DeviceManagementApps.ReadWrite.All

  • Enable Access setting: Read and write Microsoft Intune apps

  • Allows the same operations as DeviceManagementApps.Read.All

  • Also permits changes to the following entities:

    • Client Apps

    • Mobile App Categories

    • App Protection Policies

    • App Configurations

DeviceManagementConfiguration.Read.All

  • Enable Access setting: Read Microsoft Intune device configuration and policies

  • Permits read access to the following entity properties and status:

    • Device Configuration

    • Device Compliance Policy

    • Notification Messages

DeviceManagementConfiguration.ReadWrite.All

  • Enable Access setting: Read and write Microsoft Intune device configuration and policies

  • Allows the same operations as DeviceManagementConfiguration.Read.All

  • Apps can also create, assign, delete, and change the following entities:

    • Device Configuration

    • Device Compliance Policy

    • Notification Messages

DeviceManagementManagedDevices.PrivilegedOperations.All

  • Enable Access setting: Perform user-impacting remote actions on Microsoft Intune devices

  • Permits the following remote actions on a managed device:

    • Retire

    • Wipe

    • Reset/Recover Passcode

    • Remote Lock

    • Enable/Disable Lost Mode

    • Clean PC

    • Reboot

    • Delete User from Shared Device

DeviceManagementManagedDevices.Read.All

  • Enable Access setting: Read Microsoft Intune devices

  • Permits read access to the following entity properties and status:

    • Managed Device

    • Device Category

    • Detected App

    • Remote actions

    • Malware information

DeviceManagementManagedDevices.ReadWrite.All

  • Enable Access setting: Read and write Microsoft Intune devices

  • Allows the same operations as DeviceManagementManagedDevices.Read.All

  • Apps can also create, delete, and change the following entities:

    • Managed Device

    • Device Category

  • The following remote actions are also allowed:

    • Locate devices

    • Disable Activation Lock

    • Request remote assistance

DeviceManagementRBAC.Read.All

  • Enable Access setting: Read Microsoft Intune RBAC settings

  • Permits read access to the following entity properties and status:

    • Role Assignments

    • Role Definitions

    • Resource Operations

DeviceManagementRBAC.ReadWrite.All

  • Enable Access setting: Read and write Microsoft Intune RBAC settings

  • Allows the same operations as DeviceManagementRBAC.Read.All

  • Apps can also create, assign, delete, and change the following entities:

    • Role Assignments

    • Role Definitions

DeviceManagementServiceConfig.Read.All

  • Enable Access setting: Read Microsoft Intune configuration

  • Permits read access to the following entity properties and status:

    • Device Enrollment

    • Apple Push Notification Certificate

    • Apple Device Enrollment Program

    • Apple Volume Purchase Program

    • Exchange Connector

    • Terms and Conditions

    • Cloud PKI

    • Branding

    • Mobile Threat Defense

DeviceManagementServiceConfig.ReadWrite.All

  • Enable Access setting: Read and write Microsoft Intune configuration

  • Allows the same operations as DeviceManagementServiceConfig.Read.All_

  • Apps can also configure the following Intune features:

    • Device Enrollment

    • Apple Push Notification Certificate

    • Apple Device Enrollment Program

    • Apple Volume Purchase Program

    • Exchange Connector

    • Terms and Conditions

    • Cloud PKI

    • Branding

    • Mobile Threat Defense

Reference

The table lists the settings as they appear in the . The following sections describe the scopes in alphabetical order.

Microsoft Entra authentication
Application permission scopes
Microsoft Intune admin center
Microsoft Intune admin center
DeviceManagementManagedDevices.PrivilegedOperations.All
DeviceManagementManagedDevices.ReadWrite.All
DeviceManagementManagedDevices.Read.All
DeviceManagementRBAC.ReadWrite.All
DeviceManagementApps.ReadWrite.All
DeviceManagementApps.Read.All
DeviceManagementConfiguration.Read.All
DeviceManagementServiceConfig.ReadWrite.All
How to use Microsoft Entra ID to access Intune APIs in Microsoft Graph - Microsoft IntuneMicrosoftLearn
Logo