Intune RBAC & Scope
The question it answers: Which Intune role assignments let which admins wipe, retire or delete devices, and on which devices?
Who can do what in Intune, and on which devices. Intune role assignments grant groups of admins actions like wipe, retire and delete - on every device in the tenant unless scope groups or scope tags narrow them down.
At a glance
Section titled “At a glance”| Where in the app | Intune › Service & Operations › Intune RBAC & Scope |
| Workload | Intune |
| Kind | Table |
| Data | Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once. |
| Licence | Microsoft Intune. |
| Report id (API and MCP) | intune.service.intune-rbac |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Assignment | DisplayName | Text |
| Role | Secondary | Text |
| Finding | Finding | Status |
| Admins (groups) | Detail | Text |
| Scope | Category | Text |
| Scope groups | Value | Text |
What it needs
Section titled “What it needs”Licence: Microsoft Intune.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
DeviceManagementRBAC.Read.All | Microsoft Graph | Read Microsoft Intune RBAC settings | |
Group.Read.All | Microsoft Graph | Read all groups |
Data sources it reads
GET /v1.0/deviceManagement/roleAssignments?$expand=roleDefinition
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/intune.service.intune-rbac?size=100An AI assistant reads it with the MCP tool get_report and the id intune.service.intune-rbac. The client needs the Read grant for Intune. See Using the API.