Try It
Print

Azure AD Application Required Permissions

Copy the URL link to this section to share

Below are all of the permissions required to be configured on the Azure AD App Registration. Some are optional depending upon the features of BI for Intune that you intend to enable. See Create Azure AD App Registration for more information.

Prerequisites:  The user configuring these permissions requires Global Admin and Subscription Admin rights.

Required for basic functionality:

  • API: Microsoft Graph
  • Permission Type: Application
  • Permissions:
    AuditLog.Read.All DeviceManagementApps.Read.All DeviceManagementConfiguration.Read.All DeviceManagementManaged Devices.Read.All DeviceManagementRBAC.Read.All DeviceManagementServiceConfig.Read.All Directory.Read.All Policy.Read.All Reports.Read.All
Required for custom inventory and update compliance:

  • API: Log Analytics API
  • Permission Type: Application
  • Permissions: Data.Read
(Click to Enlarge)