azureblog.co.uk
← cd ~/compare
// compare · entra roles

Intune Administrator vs Cloud Device Administrator

Two Microsoft Entra built-in roles that are often confused, compared permission by permission.

In short: Intune Administrator has 38 permissions, privileged. Cloud Device Administrator has 19 permissions, privileged. Assign the one with less access that still covers the job, and use PIM for whichever is privileged.

Intune AdministratorCloud Device Administrator
What Microsoft saysCan manage all aspects of the Intune product.Limited access to manage devices in Microsoft Entra ID.
Size38 permissions, privileged19 permissions, privileged

Permissions only Intune Administrator lists (29)

  • microsoft.azure.supportTickets/allEntities/allTasks
  • microsoft.cloudPC/allEntities/allProperties/allTasks
  • microsoft.directory/contacts/basic/update
  • microsoft.directory/contacts/create
  • microsoft.directory/contacts/delete
  • microsoft.directory/devices/basic/update
  • microsoft.directory/devices/create
  • microsoft.directory/devices/extensionAttributeSet1/update
  • microsoft.directory/devices/extensionAttributeSet2/update
  • microsoft.directory/devices/extensionAttributeSet3/update
  • microsoft.directory/devices/registeredOwners/update
  • microsoft.directory/devices/registeredUsers/update
  • microsoft.directory/groups.security/assignedLabels/update
  • microsoft.directory/groups.security/basic/update
  • microsoft.directory/groups.security/classification/update
  • microsoft.directory/groups.security/create
  • microsoft.directory/groups.security/delete
  • microsoft.directory/groups.security/dynamicMembershipRule/update
  • microsoft.directory/groups.security/members/update
  • microsoft.directory/groups.security/owners/update
  • microsoft.directory/groups.security/visibility/update
  • microsoft.directory/groups/hiddenMembers/read
  • microsoft.directory/users/basic/update
  • microsoft.directory/users/manager/update
  • microsoft.directory/users/photo/update
  • microsoft.intune/allEntities/allTasks
  • microsoft.office365.organizationalMessages/allEntities/allProperties/read
  • microsoft.office365.supportTickets/allEntities/allTasks
  • microsoft.office365.webPortal/allEntities/standard/read

Permissions only Cloud Device Administrator lists (10)

  • microsoft.azure.serviceHealth/allEntities/allTasks
  • microsoft.directory/auditLogs/allProperties/read
  • microsoft.directory/authorizationPolicy/standard/read
  • microsoft.directory/deviceManagementPolicies/basic/update
  • microsoft.directory/deviceRegistrationPolicy/basic/update
  • microsoft.directory/devices/permissions/update
  • microsoft.directory/deviceTemplates/owners/read
  • microsoft.directory/deviceTemplates/owners/update
  • microsoft.directory/signInReports/allProperties/read
  • microsoft.office365.serviceHealth/allEntities/allTasks

Permissions are listed as Microsoft writes them. A broad one, such as one ending in allTasks, can cover several narrower ones listed for the other role.

Intune Administrator explained Cloud Device Administrator explained

Sources