Roles and permissions

Explore Microsoft's documented roles and permissions, and follow changes to each public reference.

Source and coverage

Built-in role permission/action pairs from the Intune reference. Cloud PC roles, custom roles, assignments, scope groups and scope tags are separate.

1 of 1 reference page has a baseline · 0 failed their last read. A failed or unparsed page cannot establish that a role or permission disappeared.

These public references do not establish tenant assignments or effective access. Reference labels and anchors do not establish stable vendor template IDs or confirmed renames.

Observed changes and exact document comparisons

Saved searches 0

Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.

9 matching entries · captured 24 Oct 2026, 00:57 UTC

Article history

Role or permission	Reference type	Documented terms
Application Manager`anchor:application-manager`	Built-in role (reference anchor)	49 documented terms Admin tasks `Create` `Delete` `Read` `Update` Android Enterprise `Read` `Update app sync` Certificate Connector `Read` Cloud attached devices `Take application actions` `View applications` `View client details` `View collections` `View resource explorer` `View software updates` `View timeline` Customization `Read` Deployment Plans `Create` `Delete` `Read` `Update` Derived Credentials `Read` Device configurations `Read` Filters `Create` `Delete` `Read` `Update` Managed apps `Assign` `Create` `Delete` `Read` `Update` `Wipe` Managed devices `Read` Microsoft Defender ATP `Read` Microsoft Store For Business `Read` Mobile apps `Assign` `Create` `Delete` `Read` `Relate` `Update` Mobile Threat Defense `Read` Organization `Read` Partner Device Management `Read` Policy Sets `Assign` `Create` `Delete` `Read` `Update` Windows Enterprise Certificate `Read`
Endpoint Privilege Manager`anchor:endpoint-privilege-manager`	Built-in role (reference anchor)	14 documented terms Admin tasks `Create` `Delete` `Read` `Update` Endpoint Privilege Management Elevation Requests `Modify elevation requests` `View elevation requests` Endpoint Privilege Management Policy Authoring `Assign` `Create` `Delete` `Read` `Update` `View Reports` Managed devices `Read` Organization `Read`
Endpoint Privilege Reader`anchor:endpoint-privilege-reader`	Built-in role (reference anchor)	6 documented terms Admin tasks `Read` Endpoint Privilege Management Elevation Requests `View elevation requests` Endpoint Privilege Management Policy Authoring `Read` `View Reports` Managed devices `Read` Organization `Read`
Endpoint Security Manager`anchor:endpoint-security-manager`	Built-in role (reference anchor)	100 documented terms Admin tasks `Create` `Delete` `Read` `Update` Android Enterprise `Read` Android FOTA `Read` App Control for Business `Assign` `Create` `Delete` `Read` `Update` `View Reports` Attack Surface Reduction `Assign` `Create` `Delete` `Read` `Update` `View Reports` Audit data `Read` Certificate Connector `Read` Cloud attached devices `Run CMPivot query` `View client details` `View collections` `View resource explorer` `View scripts` `View software updates` `View timeline` Corporate device identifiers `Read` Customization `Read` Deployment Plans `Create` `Delete` `Read` `Update` Derived Credentials `Read` Device compliance policies `Assign` `Create` `Delete` `Read` `Update` `View reports` Device configurations `Read` `View Reports` Device enrollment managers `Read` Endpoint Analytics `Read` Endpoint Detection and Response `Assign` `Create` `Delete` `Read` `Update` `View Reports` Endpoint Privilege Management Elevation Requests `Modify elevation requests` `View elevation requests` Endpoint Privilege Management Policy Authoring `Assign` `Create` `Delete` `Read` `Update` `View Reports` Endpoint protection reports `Read` Enrollment programs `Read device` `Read profile` `Read token` Filters `Read` Intune data warehouse `Read` Managed apps `Read` Managed devices `Delete` `Read` `Set primary user` `Update` `View reports` Microsoft Defender ATP `Read` Microsoft Store For Business `Read` Mobile apps `Read` Mobile Threat Defense `Modify` `Read` Organization `Read` Partner Device Management `Read` Policy Sets `Read` Remote assistance connectors `Read` `View reports` Remote tasks `Get FileVault key.` `Initiate Configuration Manager action` `Reboot now` `Remote lock` `Rotate BitLockerKeys (preview)` `Rotate FileVault key.` `Shut down` `Sync devices.` `Windows defender` Roles `Read` Security baselines `Assign` `Create` `Delete` `Read` `Update` Security tasks `Read` `Update` Telecom expenses `Read` Terms and conditions `Read` Windows Enterprise Certificate `Read`
Help Desk Operator`anchor:help-desk-operator`	Built-in role (reference anchor)	92 documented terms Admin tasks `Read` Android Enterprise `Read` Android FOTA `Read` App Control for Business `Read` Attack Surface Reduction `Read` Audit data `Read` Certificate Connector `Read` Cloud attached devices `Enroll Now` `Run CMPivot query` `Run script` `Take application actions` `View applications` `View client details` `View collections` `View resource explorer` `View scripts` `View software updates` `View timeline` Corporate device identifiers `Read` Customization `Read` Deployment Plans `Read` Derived Credentials `Read` Device compliance policies `Read` `View reports` Device configurations `Read` `View Reports` Device enrollment managers `Read` Endpoint Analytics `Read` Endpoint Detection and Response `Read` Endpoint protection reports `Read` Enrollment programs `Read device` `Read profile` `Read token` Filters `Read` Managed apps `Assign` `Read` `Wipe` Managed devices `Read` `Set primary user` `Update` `View reports` Microsoft Defender ATP `Read` Microsoft Store For Business `Read` Mobile apps `Assign` `Read` Mobile Threat Defense `Read` Organization `Read` Partner Device Management `Read` Policy Sets `Read` Remote assistance connectors `Read` Remote Help app `Elevation` `Take full control` `Unattended control` `View screen` Remote tasks `Change assignments` `Clean PC` `Collect diagnostics` `Disable lost mode` `Enable lost mode` `Enable Windows IntuneAgent` `Get FileVault key.` `Indicates remote device action to initiate Mobile Device Management (MDM) attestation if device is capable for it.` `Initiate Configuration Manager action` `Locate device` `Manage shared device users` `Offer remote assistance` `Play sound to locate lost devices` `Reboot now` `Recover MDM Key` `Remote lock` `Reset passcode` `Restore Managed Home Screen` `Retire` `Revoke App Licenses` `Rotate BitLockerKeys (preview)` `Rotate FileVault key.` `Run Remediation` `Send custom notifications` `Set device name` `Shut down` `Sync devices.` `Temporarily suspend Managed Home Screen` `Update cellular data plan` `Update device account` `Windows defender` `Wipe` Roles `Read` Security baselines `Read` ServiceNow `View Incidents` Telecom expenses `Read` Terms and conditions `Read` Windows Enterprise Certificate `Read`
Intune Role Administrator`anchor:intune-role-administrator`	Built-in role (reference anchor)	6 documented terms Organization `Read` Roles `Assign` `Create` `Delete` `Read` `Update`
Policy and Profile manager`anchor:policy-and-profile-manager`	Built-in role (reference anchor)	82 documented terms Admin tasks `Create` `Delete` `Read` `Update` Android Enterprise `Read` `Update app sync` `Update enrollment profiles` `Update onboarding` Android FOTA `Read` Audit data `Read` Certificate Connector `Read` Cloud attached devices `View applications` `View client details` `View collections` `View resource explorer` `View scripts` `View software updates` `View timeline` Corporate device identifiers `Create` `Delete` `Read` `Update` Deployment Plans `Create` `Delete` `Read` `Update` Derived Credentials `Read` Device compliance policies `Assign` `Create` `Delete` `Read` `Update` `View reports` Device configurations `Assign` `Create` `Delete` `Read` `Update` `View Reports` Enrollment programs `Assign profile` `Create device` `Create profile` `Create token` `Delete device` `Delete profile` `Delete token` `Enrollment time device membership assignment` `Read device` `Read profile` `Read token` `Sync device` `Update profile` `Update token` Filters `Create` `Delete` `Read` `Update` Managed apps `Assign` `Create` `Delete` `Read` `Update` Microsoft Defender ATP `Read` Mobile Threat Defense `Read` Operating System Recovery Configurations `Assign Profiles` `Create Profiles` `Delete Profiles` `Read Profiles` `Update Profiles` Organization `Read` Partner Device Management `Read` Policy Sets `Assign` `Create` `Delete` `Read` `Update` Quiet Time policies `Assign` `Create` `Delete` `Read` `Update` `View Reports`
Read Only Operator`anchor:read-only-operator`	Built-in role (reference anchor)	55 documented terms Admin tasks `Read` Android Enterprise `Read` Android FOTA `Read` App Control for Business `Read` Attack Surface Reduction `Read` Audit data `Read` Certificate Connector `Read` Cloud attached devices `View applications` `View client details` `View collections` `View resource explorer` `View scripts` `View software updates` `View timeline` Corporate device identifiers `Read` Customization `Read` Deployment Plans `Read` Derived Credentials `Read` Device compliance policies `Read` `View reports` Device configurations `Read` `View Reports` Device enrollment managers `Read` Endpoint Analytics `Read` Endpoint Detection and Response `Read` Endpoint Privilege Management Elevation Requests `View elevation requests` Endpoint Privilege Management Policy Authoring `Read` `View Reports` Endpoint protection reports `Read` Enrollment programs `Read device` `Read profile` `Read token` Filters `Read` Intune data warehouse `Read` Managed apps `Read` Managed devices `Read` `View reports` Microsoft Defender ATP `Read` Microsoft Store For Business `Read` Mobile apps `Read` Mobile Threat Defense `Read` Organization `Read` Partner Device Management `Read` Policy Sets `Read` Quiet Time policies `Read` `View Reports` Remote assistance connectors `Read` `View reports` Remote tasks `Get FileVault key.` Roles `Read` Security baselines `Read` ServiceNow `View Incidents` Telecom expenses `Read` Terms and conditions `Read` Windows Enterprise Certificate `Read`
School Administrator`anchor:school-administrator`	Built-in role (reference anchor)	118 documented terms Admin tasks `Create` `Delete` `Read` `Update` Audit data `Read` Certificate Connector `Modify` `Read` Cloud attached devices `Enroll Now` `Run CMPivot query` `Run script` `Take application actions` `View applications` `View client details` `View collections` `View resource explorer` `View scripts` `View software updates` `View timeline` Customization `Assign` `Create` `Delete` `Read` `Update` Deployment Plans `Create` `Delete` `Read` `Update` Derived Credentials `Read` Device configurations `Assign` `Create` `Delete` `Read` `Update` Device enrollment managers `Read` `Update` Endpoint Analytics `Create` `Delete` `Read` `Update` Enrollment programs `Assign profile` `Create profile` `Create token` `Delete device` `Delete profile` `Delete token` `Enrollment time device membership assignment` `Read device` `Read profile` `Read token` `Sync device` `Update profile` `Update token` Filters `Create` `Delete` `Read` `Update` Intune data warehouse `Read` Managed apps `Create` `Delete` `Read` `Update` Managed devices `Delete` `Read` `Set primary user` `Update` Microsoft Defender ATP `Read` Microsoft Store For Business `Modify` `Read` Mobile apps `Assign` `Create` `Delete` `Read` `Relate` `Update` Mobile Threat Defense `Read` Organization `Read` Partner Device Management `Read` Policy Sets `Assign` `Create` `Delete` `Read` `Update` Remote assistance connectors `Read` `Update` `View reports` Remote Help app `Elevation` `Take full control` `View screen` Remote tasks `Change assignments` `Clean PC` `Collect diagnostics` `Disable lost mode` `Enable lost mode` `Indicates remote device action to initiate Mobile Device Management (MDM) attestation if device is capable for it.` `Initiate Configuration Manager action` `Locate device` `Offer remote assistance` `Play sound to locate lost devices` `Reboot now` `Recover MDM Key` `Remote lock` `Reset passcode` `Restore Managed Home Screen` `Retire` `Run Remediation` `Set device name` `Sync devices.` `Temporarily suspend Managed Home Screen` `Update cellular data plan` `Wipe` ServiceNow `View Incidents` Terms and conditions `Assign` `Create` `Delete` `Read` `Update` Windows Enterprise Certificate `Modify` `Read`

Roles and permissions

Intune RBAC

Admin tasks

Android Enterprise

Certificate Connector

Cloud attached devices

Customization

Deployment Plans

Derived Credentials

Device configurations

Filters

Managed apps

Managed devices

Microsoft Defender ATP

Microsoft Store For Business

Mobile apps

Mobile Threat Defense

Organization

Partner Device Management

Policy Sets

Windows Enterprise Certificate

Admin tasks

Endpoint Privilege Management Elevation Requests

Endpoint Privilege Management Policy Authoring

Managed devices

Organization

Admin tasks

Endpoint Privilege Management Elevation Requests

Endpoint Privilege Management Policy Authoring

Managed devices

Organization

Admin tasks

Android Enterprise

Android FOTA

App Control for Business

Attack Surface Reduction

Audit data

Certificate Connector

Cloud attached devices

Corporate device identifiers

Customization

Deployment Plans

Derived Credentials

Device compliance policies

Device configurations

Device enrollment managers

Endpoint Analytics

Endpoint Detection and Response

Endpoint Privilege Management Elevation Requests

Endpoint Privilege Management Policy Authoring

Endpoint protection reports

Enrollment programs

Filters

Intune data warehouse

Managed apps

Managed devices

Microsoft Defender ATP

Microsoft Store For Business

Mobile apps

Mobile Threat Defense

Organization

Partner Device Management

Policy Sets

Remote assistance connectors

Remote tasks

Roles

Security baselines

Security tasks

Telecom expenses

Terms and conditions

Windows Enterprise Certificate

Admin tasks

Android Enterprise

Android FOTA

App Control for Business

Attack Surface Reduction

Audit data

Certificate Connector

Cloud attached devices

Corporate device identifiers