// roles/entra · privileged

Intune AdministratorMicrosoft Entra built-in role

Can manage all aspects of the Intune product.

Role ID	`3a2c62db-5318-420d-8d74-23affee5d9d5`
Privileged	Yes. Microsoft marks this role as privileged.
Permissions	38

Before you assign it

Microsoft labels this a privileged role, so make it eligible through PIM rather than permanent, require phishing-resistant MFA to activate it, and review who has it regularly.

What it can do

Permission	What it allows
`microsoft.azure.supportTickets/allEntities/allTasks`	Create and manage Azure support tickets
`microsoft.cloudPC/allEntities/allProperties/allTasks`	Manage all aspects of Windows 365
`microsoft.directory/bitlockerKeys/key/read`	Read bitlocker metadata and key on devices
`microsoft.directory/contacts/basic/update`	Update basic properties on contacts
`microsoft.directory/contacts/create`	Create contacts
`microsoft.directory/contacts/delete`	Delete contacts
`microsoft.directory/deletedItems.devices/delete`	Permanently delete devices, which can no longer be restored
`microsoft.directory/deletedItems.devices/restore`	Restore soft deleted devices to original state
`microsoft.directory/deviceLocalCredentials/password/read`	Read all properties of the backed up local administrator account credentials for Microsoft Entra joined devices, including the password
`microsoft.directory/deviceManagementPolicies/standard/read`	Read standard properties on mobile device management and mobile app management policies
`microsoft.directory/deviceRegistrationPolicy/standard/read`	Read standard properties on device registration policies
`microsoft.directory/devices/basic/update`	Update basic properties on devices
`microsoft.directory/devices/create`	Create devices (enroll in Microsoft Entra ID)
`microsoft.directory/devices/delete`	Delete devices from Microsoft Entra ID
`microsoft.directory/devices/disable`	Disable devices in Microsoft Entra ID
`microsoft.directory/devices/enable`	Enable devices in Microsoft Entra ID
`microsoft.directory/devices/extensionAttributeSet1/update`	Update the extensionAttribute1 to extensionAttribute5 properties on devices
`microsoft.directory/devices/extensionAttributeSet2/update`	Update the extensionAttribute6 to extensionAttribute10 properties on devices
`microsoft.directory/devices/extensionAttributeSet3/update`	Update the extensionAttribute11 to extensionAttribute15 properties on devices
`microsoft.directory/devices/registeredOwners/update`	Update registered owners of devices
`microsoft.directory/devices/registeredUsers/update`	Update registered users of devices
`microsoft.directory/groups.security/assignedLabels/update`	Update the assigned labels property on Security groups of assigned membership type, excluding role-assignable groups
`microsoft.directory/groups.security/basic/update`	Update basic properties on Security groups, excluding role-assignable groups
`microsoft.directory/groups.security/classification/update`	Update the classification property on Security groups, excluding role-assignable groups
`microsoft.directory/groups.security/create`	Create Security groups, excluding role-assignable groups
`microsoft.directory/groups.security/delete`	Delete Security groups, excluding role-assignable groups
`microsoft.directory/groups.security/dynamicMembershipRule/update`	Update the dynamic membership rule on Security groups, excluding role-assignable groups
`microsoft.directory/groups.security/members/update`	Update members of Security groups, excluding role-assignable groups
`microsoft.directory/groups.security/owners/update`	Update owners of Security groups, excluding role-assignable groups
`microsoft.directory/groups.security/visibility/update`	Update the visibility property on Security groups, excluding role-assignable groups
`microsoft.directory/groups/hiddenMembers/read`	Read hidden members of Security groups and Microsoft 365 groups, including role-assignable groups
`microsoft.directory/users/basic/update`	Update basic properties on users
`microsoft.directory/users/manager/update`	Update manager for users
`microsoft.directory/users/photo/update`	Update photo of users
`microsoft.intune/allEntities/allTasks`	Manage all aspects of Microsoft Intune
`microsoft.office365.organizationalMessages/allEntities/allProperties/read`	Read all aspects of Microsoft 365 Organizational Messages
`microsoft.office365.supportTickets/allEntities/allTasks`	Create and manage Microsoft 365 service requests
`microsoft.office365.webPortal/allEntities/standard/read`	Read basic properties on all resources in the Microsoft 365 admin center

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Intune Administrator for <reason>"
    RoleDefinitionId = "3a2c62db-5318-420d-8d74-23affee5d9d5"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '3a2c62db-5318-420d-8d74-23affee5d9d5'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Partner Tier1 Support · 40 permissions · privileged
Directory Writers · 42 permissions · privileged
Security Reader · 33 permissions · privileged
AI Reader · 45 permissions · privileged
Partner Tier2 Support · 46 permissions · privileged
Privileged Role Administrator · 28 permissions · privileged
Tenant Governance Administrator · 24 permissions · privileged
Privileged Authentication Administrator · 20 permissions · privileged

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles