Intune Permissions

i About these permissions

This is the complete permission set the SoftwareCentral installer applies to the app registration. The Application Manager Only edition actively uses the Application Deployment and Group Management permissions to create applications and deploy them to groups. The device, user, BitLocker and mail permissions back full-product features and are harmless to leave granted.

1 API permissions

Sign in (Delegated permissions)

Application Deployment (Application permissions) used by AM-Only

Group Management (Application permissions) used by AM-Only

Dashboards (Application permissions, read) used by AM-Only

Patch Flows, Version currency, Rollouts, Deployments and Content & DPs need no Intune permission. To check them all at once, open Settings › Configuration › Intune Configuration, open the tenant and press Test connection and permissions: the window lists these permissions under Application Manager Only dashboards, with what each dashboard loses without it.

Device Management (Application permissions)

User Management (Application permissions)

Mail (Application permissions)

2 Azure database

If your database is located in Azure, the following application permission is required:

If you cannot find this permission in the Azure portal, try the following:

1. Create an Azure SQL database and add yourself as either an admin or a user.
2. Log in to that database with Microsoft SQL Management Studio using your Entra ID credentials.
3. You can now search for the permission "Azure SQL Database".

3 Service account

A service account is required to read BitLocker recovery keys, reset user passwords and, in some scenarios, to send mails. The Application Manager Only edition does not use these features, so a service account is generally not needed — add one only if your organization uses those full-product features.

To read BitLocker recovery keys, the service account defined under settings must be a member of one of the following roles:

4 Required permissions manifest

Add the snippet below to your app registration manifest to apply the required permissions in one step. Remember to grant admin consent after you update the manifest.

"requiredResourceAccess": [
    {
        "resourceAppId": "022907d3-0f1b-48f7-badc-1ba6abab6d66",
        "resourceAccess": [
            { "id": "c39ef2d1-04ce-46dc-8b5f-e9a5c60f0fc9", "type": "Role" }
        ]
    },
    {
        "resourceAppId": "00000003-0000-0000-c000-000000000000",
        "resourceAccess": [
            { "id": "14dad69e-099b-42c9-810b-d002981feec1", "type": "Scope" },
            { "id": "7427e0e9-2fba-42fe-b0c0-848c9e6a8182", "type": "Scope" },
            { "id": "e1fe6dd8-ba31-4d61-89e7-88639da4683d", "type": "Scope" },
            { "id": "1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9", "type": "Role" },
            { "id": "e383f46e-2787-4529-855e-0e479a3ffac0", "type": "Scope" },
            { "id": "37f7f235-527c-4136-accd-4a02d197296e", "type": "Scope" },
            { "id": "64a6cdd6-aab1-4aaf-94b8-3cc8405e90d0", "type": "Scope" },
            { "id": "b27a61ec-b99c-4d6a-b126-c4375d08ae30", "type": "Scope" },
            { "id": "62a82d76-70ea-41e2-9197-370581804d09", "type": "Role" },
            { "id": "9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8", "type": "Role" },
            { "id": "2f51be20-0bb4-4fed-bf7b-db946066c75e", "type": "Role" },
            { "id": "741f803b-c850-494e-b5df-cde7c675a1ca", "type": "Role" },
            { "id": "b0afded3-3588-46d8-8b3d-9842eff778da", "type": "Role" },
            { "id": "7ab1d382-f21e-4acd-a863-ba3e13f7da61", "type": "Role" },
            { "id": "1138cb37-bd11-4084-a2b7-9f71582aeddb", "type": "Role" },
            { "id": "78145de6-330d-4800-a6ce-494ff2d33d07", "type": "Role" },
            { "id": "9241abd9-d0e6-425a-bd4f-47ba86e767a4", "type": "Role" },
            { "id": "5b07b0dd-2377-4e44-a38d-703f09a0dc3c", "type": "Role" },
            { "id": "243333ab-4d21-40cb-a475-36241daa0842", "type": "Role" },
            { "id": "5ac13192-7ace-4fcf-b828-1a26f28068ee", "type": "Role" },
            { "id": "dbaae8cf-10b5-4b86-a4a1-f871c94c6695", "type": "Role" },
            { "id": "b7887744-6746-4312-813d-72daeaee7e2d", "type": "Scope" },
            { "id": "7dd1be58-6e76-4401-bf8d-31d1e8180d5b", "type": "Role" },
            { "id": "50483e42-d915-4231-9639-7fdb7fd190e5", "type": "Role" }
        ]
    }
],

The snippet does not include AdministrativeUnit.Read.All, because it is only needed when groups are created inside an administrative unit. If you use one, add this line to the Microsoft Graph resourceAccess list as well:
{ "id": "134fd756-38ce-4afd-ba33-e9623dbe66c2", "type": "Role" }

📄 Full-product reference (not shown in this edition's help): why each permission is needed, what stops working without it and the least-privileged alternative.

5 Best practices

6 Troubleshooting