Application Manager Only guide · Reference

Intune Permissions

The Microsoft Graph and Intune API permissions the SoftwareCentral app registration requires. Assign these to the app registration and grant admin consent so the Application Manager Only edition can create and deploy applications.

i About these permissions

This is the complete permission set the SoftwareCentral installer applies to the app registration. The Application Manager Only edition actively uses the Application Deployment and Group Management permissions to create applications and deploy them to groups. The device, user, BitLocker and mail permissions back full-product features and are harmless to leave granted.

Grant admin consent After assigning permissions (manually or via the manifest), always grant admin consent on behalf of the organization. It can take a few minutes for newly assigned permissions to take effect.

1 API permissions

Sign in (Delegated permissions)

  • email
  • offline_access
  • openid
  • profile

Application Deployment (Application permissions) used by AM-Only

  • Application.ReadWrite.All
  • DeviceManagementApps.ReadWrite.All
  • Group.ReadWrite.All
  • Directory.Read.All
  • GroupMember.ReadWrite.All

Group Management (Application permissions) used by AM-Only

  • RoleManagement.ReadWrite.Directory — only required to add members to role-assignable groups.

Device Management (Application permissions)

  • Device.ReadWrite.All
  • DeviceManagementConfiguration.ReadWrite.All
  • DeviceManagementServiceConfig.ReadWrite.All
  • DeviceManagementManagedDevices.ReadWrite.All
  • DeviceManagementManagedDevices.PrivilegedOperations.All
  • WindowsUpdates.ReadWrite.All
  • BitlockerKey.Read.All
  • CloudPC.ReadWrite.All
  • DeviceLocalCredential.Read.All
  • DeviceManagementRBAC.Read.All
  • DeviceManagementScripts.ReadWrite.All

User Management (Application permissions)

  • User.ReadWrite.All
  • Auditlog.Read.All
  • UserAuthenticationMethod.ReadWrite.All

Mail (Application permissions)

  • Mail.Send — only required if you do not want to send mails on behalf of the service accounts.

2 Azure database

If your database is located in Azure, the following application permission is required:

  • Azure SQL Database – app_impersonation

If you cannot find this permission in the Azure portal, try the following:

  1. Create an Azure SQL database and add yourself as either an admin or a user.
  2. Log in to that database with Microsoft SQL Management Studio using your Entra ID credentials.
  3. You can now search for the permission "Azure SQL Database".
Searching for the Azure SQL Database permission
Search for the Azure SQL Database permission.
Selecting Application permissions and app_impersonation
Choose Application permissions → app_impersonation.

3 Service account

A service account is required to read BitLocker recovery keys, reset user passwords and, in some scenarios, to send mails. The Application Manager Only edition does not use these features, so a service account is generally not needed — add one only if your organization uses those full-product features.

If you do add a service account It must be created in Azure — it cannot be a synced on-premise account — and it must have multi-factor authentication disabled.

To read BitLocker recovery keys, the service account defined under settings must be a member of one of the following roles:

  • Cloud device administrator
  • Helpdesk administrator
  • Intune service administrator
  • Security administrator
  • Security reader
  • Global reader
  • Global administrator

4 Required permissions manifest

Add the snippet below to your app registration manifest to apply the required permissions in one step. Remember to grant admin consent after you update the manifest.

Show app registration manifest snippet 
"requiredResourceAccess": [
    {
        "resourceAppId": "022907d3-0f1b-48f7-badc-1ba6abab6d66",
        "resourceAccess": [
            { "id": "c39ef2d1-04ce-46dc-8b5f-e9a5c60f0fc9", "type": "Role" }
        ]
    },
    {
        "resourceAppId": "00000003-0000-0000-c000-000000000000",
        "resourceAccess": [
            { "id": "14dad69e-099b-42c9-810b-d002981feec1", "type": "Scope" },
            { "id": "7427e0e9-2fba-42fe-b0c0-848c9e6a8182", "type": "Scope" },
            { "id": "e1fe6dd8-ba31-4d61-89e7-88639da4683d", "type": "Scope" },
            { "id": "1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9", "type": "Role" },
            { "id": "e383f46e-2787-4529-855e-0e479a3ffac0", "type": "Scope" },
            { "id": "37f7f235-527c-4136-accd-4a02d197296e", "type": "Scope" },
            { "id": "64a6cdd6-aab1-4aaf-94b8-3cc8405e90d0", "type": "Scope" },
            { "id": "b27a61ec-b99c-4d6a-b126-c4375d08ae30", "type": "Scope" },
            { "id": "62a82d76-70ea-41e2-9197-370581804d09", "type": "Role" },
            { "id": "9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8", "type": "Role" },
            { "id": "2f51be20-0bb4-4fed-bf7b-db946066c75e", "type": "Role" },
            { "id": "741f803b-c850-494e-b5df-cde7c675a1ca", "type": "Role" },
            { "id": "b0afded3-3588-46d8-8b3d-9842eff778da", "type": "Role" },
            { "id": "7ab1d382-f21e-4acd-a863-ba3e13f7da61", "type": "Role" },
            { "id": "1138cb37-bd11-4084-a2b7-9f71582aeddb", "type": "Role" },
            { "id": "78145de6-330d-4800-a6ce-494ff2d33d07", "type": "Role" },
            { "id": "9241abd9-d0e6-425a-bd4f-47ba86e767a4", "type": "Role" },
            { "id": "5b07b0dd-2377-4e44-a38d-703f09a0dc3c", "type": "Role" },
            { "id": "243333ab-4d21-40cb-a475-36241daa0842", "type": "Role" },
            { "id": "5ac13192-7ace-4fcf-b828-1a26f28068ee", "type": "Role" },
            { "id": "dbaae8cf-10b5-4b86-a4a1-f871c94c6695", "type": "Role" },
            { "id": "b7887744-6746-4312-813d-72daeaee7e2d", "type": "Scope" },
            { "id": "7dd1be58-6e76-4401-bf8d-31d1e8180d5b", "type": "Role" },
            { "id": "50483e42-d915-4231-9639-7fdb7fd190e5", "type": "Role" }
        ]
    }
],

📄 Original page: Intune Permissions · Related: Intune Configuration

← Related
2 · Azure App Registration