← All Roles

Intune Administrator

PrivilegedEnabled
Versionv1
Date Added2026-06-21
Categorydevices,identity
Assignment Modeallowed
Built-inYes
Template ID3a2c62db-5318-420d-8d74-23affee5d9d5

Attack path

An Intune Administrator can deploy scripts, applications and configuration profiles to managed endpoints and may be able to retrieve recovery information such as BitLocker keys. An attacker could target an administrator's managed workstation with a malicious deployment, then capture credentials or hijack an authenticated session from that device. Successful execution on a privileged access workstation could turn endpoint-management rights into an Entra identity compromise, although the path depends on the target device being enrolled and within the attacker's administrative scope.

Description

Can manage all aspects of the Intune product.

Details

Users with this role have global permissions within Microsoft Intune Online, when the service is present. Additionally, this role contains the ability to manage users and devices in order to associate policy, as well as create and manage groups.

Directory Actions38

ActionCondition
microsoft.azure.supportTickets/allEntities/allTasksnull
microsoft.cloudPC/allEntities/allProperties/allTasksnull
microsoft.directory/bitlockerKeys/key/readnull
microsoft.directory/contacts/basic/updatenull
microsoft.directory/contacts/createnull
microsoft.directory/contacts/deletenull
microsoft.directory/deletedItems.devices/deletenull
microsoft.directory/deletedItems.devices/restorenull
microsoft.directory/deviceLocalCredentials/password/readnull
microsoft.directory/deviceManagementPolicies/standard/readnull
microsoft.directory/deviceRegistrationPolicy/standard/readnull
microsoft.directory/devices/basic/updatenull
microsoft.directory/devices/createnull
microsoft.directory/devices/deletenull
microsoft.directory/devices/disablenull
microsoft.directory/devices/enablenull
microsoft.directory/devices/extensionAttributeSet1/updatenull
microsoft.directory/devices/extensionAttributeSet2/updatenull
microsoft.directory/devices/extensionAttributeSet3/updatenull
microsoft.directory/devices/registeredOwners/updatenull
microsoft.directory/devices/registeredUsers/updatenull
microsoft.directory/groups/hiddenMembers/readnull
microsoft.directory/groups.security/assignedLabels/updatenull
microsoft.directory/groups.security/basic/updatenull
microsoft.directory/groups.security/classification/updatenull
microsoft.directory/groups.security/createnull
microsoft.directory/groups.security/deletenull
microsoft.directory/groups.security/dynamicMembershipRule/updatenull
microsoft.directory/groups.security/members/updatenull
microsoft.directory/groups.security/owners/updatenull
microsoft.directory/groups.security/visibility/updatenull
microsoft.directory/users/basic/updatenull
microsoft.directory/users/manager/updatenull
microsoft.directory/users/photo/updatenull
microsoft.intune/allEntities/allTasksnull
microsoft.office365.organizationalMessages/allEntities/allProperties/readnull
microsoft.office365.supportTickets/allEntities/allTasksnull
microsoft.office365.webPortal/allEntities/standard/readnull

Graph API Permissions56

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

  • BitlockerKey.ReadBasic.All
  • CloudPC.Read.All
  • CloudPC.ReadWrite.All
  • Device.CreateFromOwnedTemplate
  • Device.Read.All
  • DeviceLocalCredential.ReadBasic.All
  • DeviceManagementApps.Read.All
  • DeviceManagementApps.ReadWrite.All
  • DeviceManagementConfiguration.Read.All
  • DeviceManagementConfiguration.ReadWrite.All
  • DeviceManagementManagedDevices.Read.All
  • DeviceManagementManagedDevices.ReadWrite.All
  • DeviceManagementRBAC.Read.All
  • DeviceManagementRBAC.ReadWrite.All
  • DeviceManagementScripts.Read.All
  • DeviceManagementScripts.ReadWrite.All
  • DeviceManagementServiceConfig.Read.All
  • DeviceManagementServiceConfig.ReadWrite.All
  • DeviceTemplate.Read.All
  • DeviceTemplate.ReadWrite.All
  • Directory.Read.All
  • Group.Read.All
  • Group.ReadWrite.All
  • GroupMember.Read.All
  • GroupMember.ReadWrite.All
  • GroupSettings.Read.All
  • LicenseAssignment.Read.All
  • LicenseAssignment.ReadWrite.All
  • OrgContact.Read.All
  • Policy.Read.All
  • Policy.Read.DeviceConfiguration
  • RoleManagement.Read.CloudPC
  • RoleManagement.ReadWrite.CloudPC
  • SignInIdentifier.Read.All
  • SignInIdentifier.ReadWrite.All
  • User-ConvertToInternal.ReadWrite.All
  • User-LifeCycleInfo.Read.All
  • User-LifeCycleInfo.ReadWrite.All
  • User-Mail.ReadWrite.All
  • User-OnPremisesSyncBehavior.ReadWrite.All
  • User-PasswordProfile.ReadWrite.All
  • User.Create
  • User.DeleteRestore.All
  • User.EnableDisableAccount.All
  • User.Export.All
  • User.Invite.All
  • User.ManageIdentities.All
  • User.Read.All
  • User.ReadBasic.All
  • User.ReadWrite.All
  • User.RevokeSessions.All
  • UserAuthenticationMethod.Read.All
  • UserAuthenticationMethod.ReadWrite.All
  • UserAuthMethod-External.ReadWrite.All
  • UserAuthMethod-HardwareOATH.ReadWrite.All
  • UserAuthMethod-TAP.ReadWrite.All