Intune

What the Intune service covers in OpenAdminOS, its permissions, roles and licences.

On this page

Parts And Permissions
Users and groups
Devices and configuration
Apps
Run-Time Scopes
Roles
Licences
Agents

Managed devices, compliance and configuration policies, apps, scripts and Autopilot.

Connecting Intune requests 10 delegated Microsoft Graph read scopes on top of the four sign-in scopes. Choose all of its parts or only some of them in the connect dialog, and add the rest later in Settings, Tenants. A part is on only when every one of its scopes is granted. With your own app registration, OpenAdminOS reads the granted permissions from the token and switches on each part that is fully granted; see Own app registration.

Parts And Permissions#

Users and groups#

Users and groups that Intune assignments target, and the tenant licence profile.

Scope	Reason	Consent
`User.Read.All`	Reads users, their licence assignments, location and last sign-in, so assignments, owners and audit entries show names rather than object IDs.	Admin
`GroupMember.Read.All`	Reads groups and group membership, which policy, app and filter assignments target.	Admin
`Organization.Read.All`	Reads the tenant profile and /subscribedSkus so the status strip shows the Entra ID tier and licences, and agents that need P1 or P2 are badged.	Admin

Chat questions this part answers:

Which groups is this policy assigned to?
Which devices belong to members of the Sales group?

Devices and configuration#

Managed devices, compliance and configuration policies, update rings, scripts, Autopilot and scope tags.

Scope	Reason	Consent
`DeviceManagementManagedDevices.Read.All`	Reads Intune enrolled devices, detected apps, troubleshooting events and fleet status. Used by Compliance overview, Find inactive devices, OS update posture, Tenant health report and Chat device questions.	Admin
`DeviceManagementConfiguration.Read.All`	Reads compliance policies, configuration profiles, settings catalog policies, update policies, endpoint security policies, assignment filters, administrative templates and encryption states.	Admin
`DeviceManagementServiceConfig.Read.All`	Reads Windows Autopilot devices, Autopilot deployment profiles and enrollment configurations.	Admin
`DeviceManagementScripts.Read.All`	Reads remediations and platform scripts so Chat can explain assignment, execution and reporting gaps.	Admin
`DeviceManagementRBAC.Read.All`	Reads Intune scope tags so Chat can explain policy visibility and scope tag targeting.	Admin
`Device.Read.All`	Reads Entra device objects for stale device checks, Autopilot matching and Intune versus Entra inventory comparisons.	Admin

Chat questions this part answers:

Which devices have not synced in 30 days?
Why is this device noncompliant?
Which configuration profiles are assigned to All devices?

Apps#

Intune app deployments, app protection and app configuration policies.

Scope	Reason	Consent
`DeviceManagementApps.Read.All`	Reads Intune apps, managed app policies, app protection policies and app configuration policies so Chat can answer deployment and mobile app protection questions.	Admin

Chat questions this part answers:

Which apps are required for all users?
Which app protection policies apply to iOS?

Run-Time Scopes#

Agents may declare these. They are never requested when a tenant is connected, only when an agent that declares them runs. Writes always pause for diff confirmation.

Scope	Reason
`DeviceManagementManagedDevices.ReadWrite.All`	Changes managed device properties. Requested only when a write agent that declares it runs.
`DeviceManagementManagedDevices.PrivilegedOperations.All`	Runs remote actions such as retire and wipe. Requested only when a write agent that declares it runs.
`DeviceManagementConfiguration.ReadWrite.All`	Changes compliance and configuration policies. Requested only when a write agent that declares it runs.
`DeviceManagementServiceConfig.ReadWrite.All`	Changes Autopilot and enrollment configuration. Requested only when a write agent that declares it runs.
`DeviceManagementScripts.ReadWrite.All`	Changes remediations and platform scripts. Requested only when a write agent that declares it runs.
`DeviceManagementRBAC.ReadWrite.All`	Changes Intune roles and scope tags. Requested only when a write agent that declares it runs.
`DeviceManagementApps.ReadWrite.All`	Changes Intune apps and app policies. Requested only when a write agent that declares it runs.

Roles#

Delegated permissions never add rights: OpenAdminOS can only read what the signed-in account can read. These roles let the account read this service without permission to change it, or with the narrowest permission that covers it. See Roles for who can grant admin consent.

Role	Why
Read Only Operator (Intune role)	Views users, devices, enrollment, configuration and apps in Intune without permission to change them. Assigned in Intune, and scope tags still apply.
Global Reader	Reads all Intune data and the Entra directory without permission to change them.

Licences#

Microsoft Intune Plan 1, included in Microsoft 365 E3, E5, F3, Business Premium and EMS E3 or E5.

Agents#

Agents in the registry that declare this service. An agent cannot run while a service it declares is not connected.

Agent	Mode	Scopes
Compliance overview	`read`	`DeviceManagementManagedDevices.Read.All`
Find inactive devices	`read`	`DeviceManagementManagedDevices.Read.All`
Intune Device Posture Auditor	`read`	`DeviceManagementManagedDevices.Read.All`
Offboarding agent	`write`	`DeviceManagementManagedDevices.Read.All` `Device.Read.All` `DeviceManagementManagedDevices.PrivilegedOperations.All`
OS update posture	`read`	`DeviceManagementManagedDevices.Read.All`
Tenant health report	`read`	`DeviceManagementManagedDevices.Read.All`