DeviceManagementRBAC.Read.All
Group.Read.All
— application permissions, granted to the app registration with admin consent.
Licence: Microsoft Intune.
Endpoint:
GET /v1.0/deviceManagement/roleAssignments?$expand=roleDefinition
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
Intune RBAC & Scope
Who can do what in Intune, and on which devices. Intune role assignments grant groups of admins actions like wipe, retire and delete - on every device in the tenant unless scope groups or scope tags narrow them down.
No Intune role is assigned - only Entra Intune/Global Administrators manage Intune.