Intune and Entra Integration

There are two ways to create the integration with Intune. One option is to create an App Registration in your tenant manually and configure the required permissions yourself. Alternatively, you can use the guided integration, which will create the App Registration for you. If desired, you can use the guided integration and then manually remove any unnecessary permissions afterwards.

Below, you’ll find a list of the mandatory and optional permissions used in the integration.

Azure Active Directory Graph

Permission Name	Type	Description
Application.Read.All	Application	Read all applications. This permission is only used during the guided integration.
Directory.AccessAsUser.All	Delegated	Access your organization’s directory. This permission is only used during the guided integration.
Directory.ReadWrite.All	Application	Read and write directory data. This permission is only used during the guided integration.

Microsoft Graph

Permission Name	Type	Description
Application.Read.All	Application	Read all applications. This permission is only used during the guided integration.
Device.Read.All	Application	Read all devices (Optional)
DeviceManagementApps.Read.All	Application	Read Microsoft Intune apps (Optional)
DeviceManagementApps.ReadWrite.All	Application	Read and write Microsoft Intune apps (Mandatory)
DeviceManagementConfiguration.ReadWrite.All	Application	Read and write Microsoft Intune device configuration and policies (Optional)
DeviceManagementManagedDevices.Read.All	Application	Read Microsoft Intune devices (Optional)
DeviceManagementServiceConfig.Read.All	Application	Read Microsoft Intune configuration (Optional)
Directory.ReadWrite.All	Application	Read and write directory data (Optional)
Group.Create	Application	Create groups (Optional)
Group.Read.All	Application	Read all groups (Mandatory)
Group.ReadWrite.All	Application	Read and write all groups (Optional)
User.Read.All	Application	Read all users’ full profiles (Optional)

The optional permissions are used in the following Endpoint Admin features and can therefore be excluded if not in use:

• Application Shop
• Microsoft Store Apps
• Device Primary User alignment
• Resource Management
  • Ring Group Automation
  • Entra ID Groups