Body
Custom Role Permissions Category explanations
Admin tasks
Works as a centralized dashboard for operational tasks from multiple Intune features. It gives the ability to quickly view and act on task without having to navigate to multiple sections of the Intune portal.
Summary Table
|
Permission Category
|
What It Controls
|
Notes
|
|
Admin Tasks
|
Ability to view and act on tasks in the Admin Tasks node
|
Only shows tasks the admin already has underlying permissions for
|
|
Endpoint Privilege Management
|
Elevation request actions
|
Required for EPM tasks to appear
|
|
Defender Security Tasks
|
Security task visibility and actions
|
Required for Defender tasks to appear
|
|
Multi‑Admin Approval
|
Approval workflow actions
|
Required for MAA tasks to appear
|
Android Enterprise
Controls what an Intune admin can see or do specifically for Android Enterprise – managed devices and configurations. Allows access to enrollment modes, device management, configurations, Managed Google Play apps, etc.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Enrollment
|
AE enrollment settings, tokens, bindings
|
Often paired with Enrollment permissions
|
|
Device Management
|
View/manage Android Enterprise devices
|
Actions depend on Device permissions
|
|
Configuration
|
AE configuration profiles
|
Requires Device Configuration category
|
|
Compliance
|
AE compliance policies
|
Requires Compliance category
|
|
Apps
|
Managed Google Play apps
|
Requires Apps category
|
Android FOTA
Controls what an Intune admin can see or do specifically for Android FOTA – managed devices and configurations. Allows access to enrollment modes, device management, configurations, policies, etc.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View FOTA policies and device update status
|
Useful for helpdesk
|
|
Write
|
Create/edit FOTA policies
|
Requires Device Configuration permissions
|
|
Assign
|
Assign policies to groups
|
Requires Assign permissions
|
|
Execute
|
Trigger or schedule updates
|
OEM‑dependent; requires Device permissions
|
App Control for Business
Controls weather an admin can interact with ACfB policies that control which application are allowed to run on Windows devices (is Intune’s modern, cloud-managed evolution of Windows Defender Application Control (WDAC)).
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View ACfB policies and device status
|
Useful for helpdesk/security monitoring
|
|
Write
|
Create/edit ACfB policies
|
Requires Device Configuration permissions
|
|
Assign
|
Assign policies to groups
|
Needed for rollout and enforcement
|
|
Manage
|
Approve apps, review blocks, manage exceptions
|
Requires Device permissions
|
Attack Surface Reduction
ASR is part of Microsoft’s Defender’s security stack. Its policies reduce exposure to malware by blocking or auditing behaviors commonly use in attacks. Intune manages ASR through Endpoint Security policies, specifically Attack Surface Reduction profiles.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View ASR policies and device status
|
Useful for helpdesk/security monitoring
|
|
Write
|
Create/edit ASR policies
|
Requires Endpoint Security + Device Configuration
|
|
Assign
|
Assign policies to groups
|
Needed for rollout and enforcement
|
|
Monitor
|
Review ASR events and impact
|
Requires Defender integration
|
Audit data
Controls access to Intune’s audit logs. These logs are essential for compliance, security investigations, and change tracking.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View Intune audit logs
|
Sensitive; often restricted
|
|
Export
|
Download audit logs
|
Useful for SIEM or compliance
|
|
Search/Filter
|
Investigate changes
|
Helps with troubleshooting
|
|
No Write
|
Cannot modify anything
|
Purely observational
|
Certificate Connector
Controls who has access to the Intune Certificate Connectors that integrate Intune with your on-premises certificate infrastructure (SCEP, PKCS, etc.).
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View connector status, health, version
|
Safe for monitoring roles
|
|
Write/Manage
|
Configure, refresh, remove connectors
|
Sensitive; usually PKI/Intune engineers
|
|
Monitor
|
View alerts, troubleshoot failures
|
Useful for security and support teams
|
Chrome Enterprise
Controls who can interact with ChromeOS devices and the Chrom Enterprise connector that links Google Admin Console with Microsoft Intune.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View ChromeOS devices and connector status
|
Safe for monitoring roles
|
|
Write/Manage
|
Configure or delete the Chrome Enterprise connector
|
Sensitive; usually infra teams
|
|
Device Actions
|
Restart, wipe, lost mode, deprovision
|
Requires Device permissions
|
|
Sync
|
Trigger ChromeOS device sync
|
Requires connector to be configured
|
Cloud PKI
Controls the Microsoft Cloud PKI Certificate Authorities (CAs), certificate profiles, and certificate lifecycle operations within Intune. Microsoft Cloud PKI is a fully cloud-based PKI service that issues certificates for Intune managed devices without requiring on-premises servers or connectors
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View Cloud PKI CAs, profiles, logs
|
Safe for monitoring roles
|
|
Write/Manage
|
Create/manage Cloud PKI CAs
|
Sensitive; usually PKI/Intune engineers
|
|
Profile Management
|
Create/assign certificate profiles
|
Requires Device Configuration permissions
|
|
Monitoring
|
Track certificate lifecycle & CA health
|
Useful for security & Zero Trust teams
|
Cloud attached devices
Controls what an Intune admin can see and do with tenant-attached Configuration Manager devices inside the Intune admin center. Tenant attach brings ConfigMgr devices into Intune so admins can perform actions on them.
Summary table
|
Read
|
View tenant‑attached devices, collections, inventory
|
Safe for helpdesk roles
|
|
CMPivot
|
Run real‑time queries
|
Sensitive; Tier‑2/3 or SOC
|
|
Scripts
|
Run PowerShell scripts on devices
|
Highly sensitive
|
|
Client Actions
|
Trigger ConfigMgr client operations
|
Useful for troubleshooting
|
|
Collections
|
View collections
|
Read‑only from Intune
|
Corporate device identifiers
Controls who can interact with hardware identifiers that Intune uses to automatically mark devices as corporate during enrollment (IMEI, Serial #s, Android Enterprise enrollment identifiers, Windows Autopilot-style identifiers, etc.). Is essential to knowing if a device is corporate-owned or personally-owned.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View identifiers and match status
|
Safe for helpdesk roles
|
|
Write
|
Add identifiers (CSV or manual)
|
Used for pre‑registration
|
|
Manage
|
Edit or delete identifiers
|
Sensitive; affects enrollment classification
|
|
Classification
|
Determines corporate vs. personal
|
Impacts compliance, CA, and app policies
|
Customization
Controls access to the Tenant Administration – Customization area in Intune. Configuration of branding, support information, and end-user experience settings live here (Company Portal, Intune web portal, Intune admin center branding, Device enrollment experience branding, etc.).
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Branding
|
Logos, colors, themes
|
Affects Company Portal & enrollment
|
|
Support Info
|
IT contact details
|
Useful for helpdesk teams
|
|
Enrollment UX
|
Instructions, privacy messages
|
Impacts onboarding
|
|
Company Portal
|
App visibility, categories
|
Influences user experience
|
|
Terms & Conditions
|
Create/assign T&Cs
|
Often used for compliance
|
|
Device Categories
|
Create/edit/delete categories
|
Used for targeting and reporting
|
|
Deployment Plans
Controls interactions with Windows Autopatch deployment plans in the Intune admin center (Windows quality updates, Windows feature updates, Microsoft 365 Apps updates, Driver and firmware updates, Rollout waves, Update cadence and scheduling, etc.).
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View deployment plans and rollout status
|
Safe for monitoring roles
|
|
Write/Manage
|
Create/edit deployment plans
|
Sensitive; affects update rollout
|
|
Assign
|
Target device groups with plans
|
Controls who gets updates
|
|
Rollout Control
|
Pause/resume/advance waves
|
High‑impact; usually senior engineers
|
Derived Credentials
Controls settings that allow Intune to issue derived credentials – certificates generated from a user’s smart card (PIV/CAC) for mobile device authentication. These are used when organizations require smart-card level authentication on mobile devices but cannot physically insert a smart card.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View issuer configuration and settings
|
Safe for monitoring roles
|
|
Write/Manage
|
Configure issuer, renewal, notifications
|
Sensitive; affects authentication
|
|
Lifecycle
|
Monitor/renew derived credentials
|
Important for PIV/CAC environments
|
|
Integration
|
Works with Wi‑Fi/VPN/email profiles
|
Requires Device Configuration permissions
|
|
Device compliance policies
Controls administrative access to all compliance=related objects in Intune. They define the minimum security posture a device must meet, such as OS version, encryption, password requirements, jailbreak/rood detections, etc.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View compliance policies & results
|
Safe for helpdesk roles
|
|
Write/Manage
|
Create/edit compliance policies
|
Sensitive; affects Conditional Access
|
|
Assign
|
Target groups with compliance policies
|
Controls who must meet requirements
|
|
Monitor
|
View compliance reports
|
Useful for security & support teams
|
Device configurations
Controls all configuration profiles in Intune, defining the settings, restrictions and capabilities applied to devices across all OS platforms.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View configuration profiles & settings
|
Safe for helpdesk roles
|
|
Write/Manage
|
Create/edit profiles
|
Highly sensitive; affects device behavior
|
|
Assign
|
Target groups with profiles
|
Controls rollout and scope
|
|
Monitor
|
View deployment status & conflicts
|
Essential for troubleshooting
|
Device enrollment messages
Controls custom messages that appear to users during the device enrollment process. Can be used to provide guidance, warnings, or compliance expectations during onboarding.
Summary table
|
Area
|
What it controls
|
Notes
|
|
Read
|
View enrollment messages
|
Safe for helpdesk roles
|
|
Write/Manage
|
Create/edit messages
|
Affects onboarding UX
|
|
Assign
|
Target messages to groups
|
Controls who sees what
|
|
Lifecycle
|
Enable/disable/retire messages
|
Useful for evolving onboarding processes
|
Endpoint Analytics
Controls all analytics-related data and features under Reports – Endpoint Analytics in the Intune admin center.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View analytics dashboards & device scores
|
Safe for helpdesk/reporting
|
|
Write/Manage
|
Configure analytics settings
|
Impacts data collection
|
|
Proactive Remediations
|
Create/assign remediation scripts
|
Powerful; Tier‑2/3 only
|
|
Monitoring
|
Track trends & export data
|
Useful for operations & leadership
|
Endpoint Detection and Response
Controls the EDR onboarding and integration settings that Intune uses to connect Windows, macOS, iOS, Android, and Linux devices to Microsoft Defender for Endpoint. Used to deploy Defender for Endpoint onboarding packages and manage EDR-related security postures.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View EDR policies & onboarding status
|
Safe for monitoring roles
|
|
Write/Manage
|
Create/edit onboarding policies
|
Sensitive; affects security posture
|
|
Assign
|
Target groups with EDR policies
|
Controls onboarding scope
|
|
Lifecycle
|
Offboard/update/monitor devices
|
Critical for SOC & security teams
|
Endpoint Privilege Management Elevation Requests
Controls elevation requests submitted by end users when they attempt to run an application with elevated privileges under Endpoint Privilege Management (EPM). EPM allows organizations to remove local admin rights while still enabling users to elevate approved apps on demand. When a user requests elevation for an app that requires approval, the request appears in Intune under Endpoint Security – Endpoint Privilege Management – Elevation Requests. The permissions in this category determine who can interact with those requests.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View elevation requests & details
|
Safe for audit/helpdesk
|
|
Approve/Deny
|
Act on elevation requests
|
High‑impact; least‑privilege critical
|
|
Lifecycle
|
Track, comment, revoke, export
|
Useful for SOC & engineering
|
|
Integration
|
Works with EPM policies
|
Needed for full least‑privilege workflows
|
Endpoint Privilege Management Policy Authoring
Controls the policies that define how Endpoint Privilege Management handles application elevation on Windows devices. Elevation Requests permissions govern approvals, Policy Authoring governs the rules themselves – the logic that determines which apps can elevate, under what conditions, and whether approval is required.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View EPM policies & rule sets
|
Safe for audit or oversight roles
|
|
Write/Manage
|
Create/edit elevation rules
|
Highly sensitive; defines least‑privilege model
|
|
Assign
|
Target groups with EPM policies
|
Controls rollout and scope
|
|
Lifecycle
|
Publish, retire, version policies
|
Critical for secure operations
|
Endpoint protection reports
Controls security related reporting data under Reports for the following – Microsoft Defender Antivirus, Endpoint security, Device protection, and Threats, detections, and protection status. These reports provide visibility into malware detections, antivirus status, protection configuration, and device security posture across the fleet. It is essential for security teams, SOC analysts, and administrators responsible for monitoring endpoint protection health.
Summary Table
|
Area
|
What it controls
|
Notes
|
|
Read
|
View antivirus & protection reports
|
Safe for SOC/helpdesk/audit
|
|
Export
|
Export CSVs for analysis
|
Useful for investigations
|
|
Monitoring
|
Track protection health & trends
|
Helps identify risky devices
|
|
Integration
|
Works with EDR, AV, compliance
|
Full picture of endpoint security
|
Enrollment programs
Controls the integrations between Intune and external device enrollment services – Apple Automated Device Enrollment (ADE, formerly DEP), Android Zero-Touch Enrollment, and Windows Autopilot. These integrations allow devices to be pre-registered so that when users turn them on, they automatically enroll into Intune with the correct configuration. This category is highly sensitive because it governs the supply-chain entry point for corporate devices.
Summary Table
|
Area
|
What it controls
|
Notes
|
|
Read
|
View ADE, Zero‑Touch, Autopilot data
|
Safe for audit/helpdesk
|
|
Manage tokens
|
Renew/upload ADE tokens, configure ZT
|
High‑impact; supply‑chain sensitive
|
|
Assign profiles
|
Autopilot/ADE/Zero‑Touch profiles
|
Controls OOBE and enrollment flow
|
|
Lifecycle
|
Sync, delete, reassign devices
|
Critical for provisioning teams
|
Filters
Is a powerful targeting mechanism that lets you include or exclude devices or apps based on properties like OS version, device type, manufacturer, enrollment type, and more. They refine policy and app targeting without needing extra Azure AD groups.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View filters & rules
|
Safe for audit/helpdesk
|
|
Write/Manage
|
Create/edit/delete filters
|
High‑impact; affects targeting
|
|
Assign
|
Attach filters to policies/apps
|
Controls scope of deployments
|
|
Advanced Rules
|
Complex logic (AND/OR)
|
Useful for engineering teams
|
|
Intune data warehouse
Exposes historical Intune data for reporting, analytics, and BI tools like Power BI. It is a small but important category because it governs access to tenant-wide historical data, not just what appears in the Intune admin center.
Summary Table
|
Capability
|
Description
|
Notes
|
|
Read Data Warehouse
|
Query historical Intune data via OData
|
Core permission
|
|
Authenticate to API
|
Allows user/app to connect to the endpoint
|
Required for Power BI, scripts
|
|
Export/Analyze Data
|
Build dashboards, reports, automation
|
Read-only
|
|
No Write Access
|
Cannot modify Intune data
|
Safe for auditors
|
Managed Device Cleanup Rules
Controls the automatic cleanup settings that determine when Intune removes devices that haven’t checked in for a specified number of days. These rules help keep your Intune tenant clean, reduce clutter, and prevent stale devices from affecting compliance, reporting and licensing.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View cleanup rule settings
|
Safe for audit/reporting
|
|
Write/Manage
|
Enable/disable rules, set inactivity days
|
High‑impact; affects device lifecycle
|
|
Lifecycle
|
Automatic removal of stale devices
|
Helps maintain clean inventory
|
Managed Device Cleanup Settings
Controls the tenant-wide settings that determine how Intune automatically removes inactive or stale devices. They define when Intune should automatically delete devices that haven’t checked in for a specified number of days. It is important for maintaining a clean, accurate device inventory and preventing stale devices from affecting compliance, reporting and licensing.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View cleanup settings
|
Safe for audit/reporting
|
|
Write/Manage
|
Enable/disable cleanup, set inactivity days
|
High‑impact; affects device lifecycle
|
|
Lifecycle
|
Automatic removal of stale devices
|
Helps maintain clean inventory
|
Managed Google Play
Controls apps and configurations that come from Managed Google Play, the enterprise version of the Google Play Store used by Android Enterprise. This governs the administrative bridge between Intune and Google’s enterprise app ecosystem.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View Managed Google Play apps & sync status
|
Safe for audit/helpdesk
|
|
Approve/Sync
|
Approve apps, sync metadata
|
Core for Android Enterprise
|
|
Private Apps
|
Publish internal Android apps
|
Sensitive; developer workflows
|
|
Web Apps
|
Create/publish web apps
|
Useful for SaaS/internal portals
|
|
Availability
|
Control what users see in the Play Store
|
High‑impact for user experience
|
Managed apps
Controls all App Protection Policies (APP) and Mobile Application Management (MAM) settings in Intune. They apply at the appl level, not the device level, and are used to protect corporate data on BYOD devices (iOS/Android), Unmanaged devices, Managed devices (when using MAM-WE) and Apps integrated with the Intune SDK or App Protection Framework. This is essential for organizations implementing data loss prevention (DLP) and Zero Trust for mobile apps.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View app protection policies
|
Safe for audit/helpdesk
|
|
Write/Manage
|
Create/edit MAM/APP policies
|
High‑impact; affects data security
|
|
Assign
|
Target policies to users/apps
|
Controls who gets protection
|
|
App Config (MAM)
|
Configure app‑level settings
|
Essential for BYOD
|
Managed devices
Controls who can interact with devices enrolled in Intune. They apply to Windows, macOS, iOS/iPadOS, Android (including Android Enterprise) and Linux. It is central to day-to-day device administration and is often used to define helpdesk, Tier-2 and endpoint engineering roles.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View device inventory & details
|
Safe for helpdesk
|
|
Manage
|
Wipe, retire, restart, lock, sync
|
High‑impact; affects user devices
|
|
Lifecycle
|
Delete, reassign, categorize devices
|
Important for operations
|
|
Troubleshooting
|
View policy status, conflicts
|
Essential for engineering teams
|
Microsoft Defender ATP
Controls integration between Intune and Defender for Endpoint, including onboarding devices, enforcing threat-based compliance, and monitoring device risk. It is essential for organizations using Intune + MDE as part of their endpoint security and Zero Trust posture.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View MDE integration, risk levels, onboarding status
|
Safe for SOC/helpdesk
|
|
Write/Manage
|
Create/edit onboarding/offboarding policies
|
High‑impact; affects EDR onboarding
|
|
Assign
|
Target MDE policies to device groups
|
Controls onboarding scope
|
|
Threat‑based Compliance
|
Enforce access based on device risk
|
Core to Zero Trust
|
|
Monitoring
|
View threats, risk, remediation
|
Essential for security teams
|
Microsoft Store for Business
Controls apps that come from the legacy Microsoft Store for Business integration. Historically, MSfB allowed organizations to acquire free or paid Windows apps, assign apps to users or devices, sync apps into Intune for deployment, and manage private line-of-business apps published through MSfB. MSfB is retired, but this category still applies to tenants that previously synced MSfB apps, legacy store apps still present in Intune, and admins who need to manage or clean up old store content.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View MSfB apps & sync status
|
Safe for audit/helpdesk
|
|
Sync
|
Trigger Store app sync
|
Legacy but still functional in some tenants
|
|
Manage Apps
|
Delete, update, assign Store apps
|
Important for cleanup
|
|
Connector Management
|
View/remove MSfB connector
|
Needed for retirement workflows
|
Microsoft Tunnel Gateway
Controls all components of the Microsoft Intune Tunnel infrastructure. Microsoft Tunnel provides a modern, secure VPN for iOS, Android and Linux clients; per-app VPN; conditional access-aware secure access; integration with Microsoft Entra ID and a self-hosted gateway running on Linux. This category governs the administrative interface for the Tunnel service inside Intune.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View Tunnel sites, servers, profiles
|
Safe for monitoring
|
|
Write/Manage
|
Create/edit Tunnel sites & servers
|
High‑impact; affects VPN access
|
|
VPN Profiles
|
Create/edit per‑app and device VPN configs
|
Core to Tunnel functionality
|
|
Assignments
|
Deploy VPN profiles to users/devices
|
Controls access scope
|
|
Monitoring
|
Logs, health, connection status
|
Essential for operations
|
Mobile Threat Defense
Controls mobile threat defense solutions connected to Intune. They provide real-time mobile threat detection (Malware, Network attacks, Phishing, Device compromise (root/jailbreak), suspicious apps, behavioral anomalies, etc.). MTD integrates with Intune (Microsoft Defender for Endpoint (iOS/Android), Lookout for Work, Zimperium zIPS, Pradeo, Symantec MTD, Check Point SandBlast Mobile, etc.).
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View MTD connectors, risk levels, threat data
|
Safe for SOC/helpdesk
|
|
Write/Manage
|
Configure connectors, tokens, integration
|
High‑impact; affects threat detection
|
|
App Deployment
|
Deploy MTD apps to devices
|
Required for threat reporting
|
|
Threat‑based Compliance
|
Enforce access based on risk
|
Core to Zero Trust
|
|
Monitoring
|
View threats, risk, remediation
|
Essential for security teams
|
Mobile apps
Controls administrative access to all app objects in Intune (Win32 apps, Microsoft Store apps, iOS/iPadOS apps, Android/Android Enterprise apps, macOS apps, Web apps, Line-of-business (LOB) apps, Store-integrated apps (Managed Google Play, VPP, etc.)). This is essential for app deployment teams, platform administrators, and anyone responsible for application lifecycle management.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View all apps & deployment status
|
Safe for audit/helpdesk
|
|
Write/Manage
|
Add/edit/delete apps
|
High‑impact; affects app catalog
|
|
Assignments
|
Deploy apps to users/devices
|
Controls who gets what
|
|
Lifecycle
|
Retire, supersede, update apps
|
Essential for app hygiene
|
|
Monitoring
|
Track install success/failure
|
Critical for operations
|
Multi Admin Approval
MAA is Intune’s built-in safeguard for preventing unauthorized or risky changes, similar in spirit to ‘two-person integrity’ or four-eyes approval’ models used in high-security environments. This is essential for Zero Trust administration and protecting against insider threats or compromised admin accounts.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View workflows, approvals, history
|
Safe for audit/compliance
|
|
Manage
|
Create/edit approval workflows
|
High‑impact; defines governance
|
|
Approve/Deny
|
Act on pending admin requests
|
Core operational function
|
|
Audit
|
Review approval logs
|
Essential for compliance
|
Operating System Recovery Configurations
Controls Windows OS recovery settings in Intune. These settings define how devices can recover, reset or restore their operating system using cloud-based or local recovery options. Especially needed for organizations using Windows Autopatch, Windows Autopilot reset, Cloud Recover/Cloud Reset, Push-button reset (PBR) and Self-service recovery options for end users.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View OS recovery policies
|
Safe for audit/helpdesk
|
|
Write/Manage
|
Create/edit recovery configurations
|
High‑impact; affects device restore behavior
|
|
Assignments
|
Target recovery policies to devices
|
Controls recovery capability scope
|
|
Lifecycle
|
Retire, update, validate policies
|
Essential for resilience planning
|
Organization
Controls global Intune tenant settings (branding, contact information, support details and certain tenant-wide behaviors). They appear in Tenant administration – Customization, Intune roles – Tenant-wide settings and Terms and conditions (as well as other global configuration areas). This category affect the identity, branding, and user-facing experience across the entire tenant.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View organization branding & settings
|
Safe for audit/helpdesk
|
|
Write/Manage
|
Edit branding, support info, T&C
|
High‑impact; affects all users
|
|
Customization
|
Company Portal look & feel
|
Important for user experience
|
|
Tenant‑wide UX
|
Enrollment & portal messaging
|
Affects onboarding and support
|
Organizational Messages
Controls messages sent to users through the Windows Organizational Messages platform. These messages allow IT and communication teams to deliver native, secure, non-email notifications to Windows 11 devices (Taskbar messages, Notification center messages, Get Started app messages, Lock screen messages, etc.). These messages are ideal for communicating security reminders, policy changes, outage notifications, training prompts, organizational announcements, and onboarding guidance.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View messages, templates, schedules
|
Safe for audit/helpdesk
|
|
Write/Manage
|
Create/edit message content
|
High‑impact; user‑facing
|
|
Assignments
|
Target messages to users/devices
|
Controls who sees what
|
|
Lifecycle
|
Publish, pause, retire messages
|
Essential for communications governance
|
Partner Device Management
Controls partner integrations that extend Intune’s device-management capabilities (Mobile Device Management partners, Mobile Application Management partners, Unified Endpoint Management partners, Security or compliance partners, and Telecom or carrier-based device management solutions.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View partner integrations & device data
|
Safe for audit/helpdesk
|
|
Write/Manage
|
Configure partner connections
|
High‑impact; affects external access
|
|
Partner Devices
|
View/manage partner‑managed devices
|
Depends on partner capabilities
|
|
Compliance Mapping
|
Use partner signals for compliance
|
Core to Zero Trust
|
|
Monitoring
|
Logs, sync status, troubleshooting
|
Essential for operations
|
Policy Sets
Controls can interact with Policy sets, a feature in Intune that lets you bundle multiple resources into a single, reusable deployment package (apps, app configuration policies, app protection (MAM) policies, device configuration profile, compliance policies, enrollment profiles, scripts, filters, terms and conditions, organizational messages, etc.). They are often used for role-based provisioning, device onboarding bundles, app + policy + configuration groupings, and standardized deployments for departments or personas.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View Policy Sets & contents
|
Safe for audit/helpdesk
|
|
Write/Manage
|
Create/edit Policy Sets
|
High‑impact; bundles many resources
|
|
Assignments
|
Deploy Policy Sets to groups
|
Controls who gets the bundle
|
|
Lifecycle
|
Publish, retire, duplicate
|
Essential for provisioning workflows
|
Quite Time policies
These policies allow organizations to silence work-related notifications from Microsoft apps during non-working hours on – iOS/iPadOS, Android, Microsoft Teams mobile, Outlook mobile, Other Microsoft 365 mobile apps that support Quiet Time. These policies help reduce after-hours interruptions, support work-life balance, and meet labor-law requirements in some regions.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View Quiet Time policies
|
Safe for HR/compliance/helpdesk
|
|
Write/Manage
|
Create/edit Quiet Time settings
|
High‑impact; affects notifications
|
|
Assignments
|
Target policies to users
|
Controls who gets Quiet Time
|
|
Lifecycle
|
Retire, duplicate, monitor
|
Important for wellbeing governance
|
Remote Help app
Remote help is used by support teams to remotely assist users, view or control a user’s screen, elevate to admin privileges (with user consent), troubleshoot devices securely, log and audit support sessions, etc. This category governs the administrative side of Remote Help – not the act of providing help itself.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View Remote Help settings & logs
|
Safe for audit/helpdesk
|
|
Write/Manage
|
Configure Remote Help behavior
|
High‑impact; affects remote access
|
|
Assignments
|
Define who can help or receive help
|
Core to support workflows
|
|
Monitoring
|
Audit sessions, elevation, activity
|
Essential for compliance
|
Remote assistance connectors
Controls integrations between Intune and external remote support solutions. They allow Intune to work with partner remote-assistance platforms (TeamViewer and other vendors that integrate through Intune’s connector model). This category governs the administrative interface for enabling, configuring, and monitoring these integrations.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View connector status & settings
|
Safe for audit/helpdesk
|
|
Write/Manage
|
Configure connectors & authentication
|
High‑impact; affects remote access
|
|
Assignments
|
Define who can use remote assistance
|
Core to support workflows
|
|
Monitoring
|
Logs, health, troubleshooting
|
Essential for operations
|
Remote tasks
Controls management of remote device actions from the Intune admin center. They allow administrators to remotely interact with devices for troubleshooting, security, and lifecycle management. They can apply across multiple platforms – Windows, macOS, iOS/iPadOS, and Android/Android Enterprise. This category is essential for helpdesk, Tier-2 support, and endpoint operations teams.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View remote actions & history
|
Safe for audit/helpdesk
|
|
Manage
|
Perform remote actions (wipe, lock, restart, sync)
|
High‑impact; affects user devices
|
|
Security
|
Key rotation, malware scan
|
Requires careful delegation
|
|
Lifecycle
|
Retire, delete, reset devices
|
Core to device operations
|
|
Roles
Controls Intune custom roles and role assignments. This governs administrative power within Intune. Foundational for delegated administration, least-privilege role design, scoped administration, governance and compliance, and separation of duties. It is one of the highest-impact permission categories in Intune.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View roles, permissions, assignments
|
Safe for audit/compliance
|
|
Write/Manage
|
Create/edit roles & permissions
|
High‑impact; defines admin power
|
|
Assignments
|
Assign roles to groups
|
Controls who can administer Intune
|
|
Scope Tags
|
Define admin boundaries
|
Essential for segmentation
|
|
Governance
|
Enforce least‑privilege RBAC
|
Critical for security
|
Security baselines
Controls Microsoft-provided security baselines in Intune. Examples of curated collections of recommended security settings create by Microsoft are – Windows 10/11, Microsoft Edge, Microsoft Defender for Endpoint, and Microsoft 365 Apps for Enterprise. These provide secure, opinionated starting points for hardening devices without manually configuring hundreds of settings.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View baselines, versions, compliance
|
Safe for audit/helpdesk
|
|
Write/Manage
|
Create/edit baseline profiles
|
High‑impact; affects device security
|
|
Assignments
|
Deploy baselines to groups
|
Controls security posture
|
|
Lifecycle
|
Upgrade, retire, compare versions
|
Essential for secure operations
|
Security tasks
Controls security-related tasks that surface in Intune from Microsoft Defender for Endpoint (MDE). They represent recommended remediation actions generated by Defender when it detects vulnerabilities, misconfigurations, or threats on devices. Tasks appear in Intune when Defender for Endpoint is integrated with Intune, Defender identifies a threat, vulnerability, or required remediation, Defender creates a ‘security task’ for Intune to act on, or Intune administrators need to approve, assign or complete a task.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View security tasks & details
|
Safe for SOC visibility
|
|
Approve/Reject
|
Decide whether remediation proceeds
|
High‑impact; affects security posture
|
|
Manage
|
Assign, complete, track tasks
|
Core to remediation workflows
|
|
Audit
|
Review historical tasks & trends
|
Important for compliance
|
ServiceNow
Controls the integration between Intune and ServiceNow Change Management. Integration allows Intune to require ServiceNow change requests for sensitive actions, validate approval status before executing actions, log Intune actions into ServiceNow for audit and compliance, and Enforce ITIL-aligned change control processes. Essential for organizations with strict governance, compliance or ITSM requirements.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View ServiceNow integration & logs
|
Safe for audit/compliance
|
|
Write/Manage
|
Configure connector & approval rules
|
High‑impact; affects governance
|
|
Workflow Mapping
|
Map Intune actions to change requests
|
Core to ITSM alignment
|
|
Monitoring
|
Health, logs, troubleshooting
|
Essential for operations
|
Telecom expenses
Controls telecom-related data for mobile devices enrolled in Intune (Voice minutes, SMS usage, Mobile data consumption, Roaming usage, Cost or billing-related data (when provided by carriers or imported)). This is especially relevant for organizations that manage corporate mobile plans, need to track roaming or overage costs, monitor data usage for compliance, or use Intune’s telecom expense management (TEM) capabilities.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View telecom usage & cost data
|
Safe for finance/helpdesk
|
|
Write/Manage
|
Configure telecom policies & thresholds
|
High‑impact; affects cost control
|
|
Assignments
|
Apply policies to groups
|
Controls who is monitored or restricted
|
|
Reporting
|
Analyze usage & trends
|
Essential for cost optimization
|
Tenant attached recommendations
Controls recommendations that appear in Intune when Configuration Manager (ConfigMgr) is tenant=attached. These recommendations come from – Endpoint analytics, ConfigMgr insights, Cloud-based device health signals, Security and configuration posture assessments. These help administrators identify issues, optimize performance, and improve device health across hybrid-managed environments.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View recommendations & insights
|
Safe for audit/helpdesk
|
|
Manage
|
Apply or dismiss recommendations
|
High‑impact; affects device posture
|
|
Remediation
|
Trigger fixes or scripts
|
Core to hybrid management
|
|
Monitoring
|
Track remediation progress
|
Essential for operations
|
Terms and conditions
Controls Terms and Conditions (T&C) documents in Microsoft Intune. They are presented to users during – Device enrollment, Company Portal sign-in, and in App access. Users must accept the T&C before proceeding, making this a key compliance and governance feature.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View T&C content, versions, assignments
|
Safe for audit/compliance
|
|
Write/Manage
|
Create/edit T&C documents
|
High‑impact; legal implications
|
|
Assignments
|
Deploy T&C to user groups
|
Controls who must accept terms
|
|
Lifecycle
|
Versioning, retirement, acceptance tracking
|
Essential for governance
|
Windows Enterprise Certificate
Controls certificate profiles used by Windows devices for certificate-based authentication (CBA), Wi-Fi and VPN authentication, S/MIME email signing and encryption, client authentication for on-premises or cloud resources, and PKI-based identity scenarios. This also governs Intune’s ability to deliver enterprise certificates to Windows devices using – SCEP (Simple Certificate Enrollment Protocol), PKCS (Public Key Cryptography Standards), PKCS imported certificates, and Cloud PKI (if used in combination). This is essential for secure access, Zero Trust, and identity-drive device management.
Summary Table
|
Area
|
What It Controls
|
Notes
|
|
Read
|
View certificate profiles & status
|
Safe for audit/helpdesk
|
|
Write/Manage
|
Create/edit SCEP/PKCS profiles
|
High‑impact; affects authentication
|
|
Assignments
|
Deploy certificates to groups
|
Controls device identity
|
|
Lifecycle
|
Renewal, retirement, troubleshooting
|
Essential for secure operations
|