IntuneBrewPermissions
The Microsoft Graph permissions and Intune roles IntuneBrew needs, for the web portal and the PowerShell tool.
Web portal
The portal signs you in with your own Microsoft Entra account and acts on your behalf (delegated permissions). It can never do more than your account is allowed to do in Intune.
Microsoft Graph permissions
At sign-in, IntuneBrew asks to sign you in and for two permissions:
| Permission | Used for |
|---|---|
DeviceManagementApps.ReadWrite.All | Reading your Intune apps, publishing updates, and changing app assignments |
Group.Read.All | Showing group names in reviews and choosing groups for update rings |
Some features ask for one more read-only permission the first time you open them. People who never use the feature are never asked.
| Permission | Asked for when you |
|---|---|
DeviceManagementRBAC.Read.All | Browse role scope tags in Settings |
DeviceManagementManagedDevices.Read.All | Open the fleet dashboard, a device's apps, or affected devices for a vulnerability |
If your tenant doesn't let users consent to apps, an Entra administrator approves each permission the first time it's requested. Administrators can tick Consent on behalf of your organization in the Microsoft consent window so colleagues aren't asked.
Intune roles
Graph permissions only allow what your Intune role allows.
| To | Your account needs |
|---|---|
| Publish apps and change assignments | Application Manager, Intune Administrator, or a custom role with Mobile apps permissions |
| See the fleet dashboard and affected devices | Intune Administrator, or a custom role with Managed devices: Read |
If you use Intune scope tags, set the scope tags to apply in Settings so new apps are visible to your role.
IntuneBrew team roles
On top of Microsoft's permissions, IntuneBrew has its own roles (owner, administrator, viewer) that decide who in your team can publish and change shared settings. See Team access and roles.
PowerShell tool
| Sign-in method | Permissions |
|---|---|
| Interactive session | Delegated DeviceManagementApps.ReadWrite.All and Group.Read.All, plus an Intune role that can manage apps |
| App registration (certificate or secret) | Application permissions DeviceManagementApps.ReadWrite.All and Group.Read.All, with admin consent |
| Azure Automation managed identity | Application permission DeviceManagementApps.ReadWrite.All; add Group.Read.All when copying assignments |
See Install and connect for creating the app registration and Run on a schedule for managed identities.