Intune Administrator

Privilegiada

Control PlaneEntraOps · EAMDevice

Dado verificado em 30/06/2026 · Fonte

Role Actions

Control Plane

Management Plane

User Access

Template ID

3a2c62db-5318-420d-8d74-23affee5d9d5

Categoria

Device

EAM Tier

Control Plane (Tier 0)

Enterprise Access Model: Control Plane

Controle total do tenant. Comprometimento leva a takeover completo. Isole de planos inferiores.

Esta role é classificada como Control Plane porque 27 de 38 ações (71%) são desse tier — o tier da role acompanha sempre a ação de maior privilégio, não o conjunto.

27 Control Plane11 Management Plane

Descrição

Can manage all aspects of the Intune product.

Role Definition (JSON)

{
  "@odata.type": "#microsoft.graph.unifiedRoleDefinition",
  "id": "3a2c62db-5318-420d-8d74-23affee5d9d5",
  "displayName": "Intune Administrator",
  "description": "Can manage all aspects of the Intune product.",
  "isBuiltIn": true,
  "isEnabled": true,
  "isPrivileged": true,
  "rolePermissions": [
    {
      "allowedResourceActions": [
        "microsoft.directory/bitlockerKeys/key/read",

Permissões completas

Todas as 38 role actions desta role, classificadas por tier do EAM.

Role Action	Categoria	Tier
`microsoft.directory/bitlockerKeys/key/read`	Global Endpoint Bitlocker Recovery	Tier 0
`microsoft.directory/deletedItems.devices/delete`	Global Endpoint Management	Tier 0
`microsoft.directory/deletedItems.devices/restore`	Global Endpoint Management	Tier 0
`microsoft.directory/deviceLocalCredentials/password/read`	Global Endpoint Local Admin	Tier 0
`microsoft.directory/devices/basic/update`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/create`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/delete`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/disable`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/enable`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/extensionAttributeSet1/update`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/extensionAttributeSet2/update`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/extensionAttributeSet3/update`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/registeredOwners/update`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/registeredUsers/update`	Global Endpoint Management	Tier 0
`microsoft.directory/groups.security/assignedLabels/update`	Group Management	Tier 0
`microsoft.directory/groups.security/basic/update`	Group Management	Tier 0
`microsoft.directory/groups.security/classification/update`	Group Management	Tier 0
`microsoft.directory/groups.security/create`	Group Management	Tier 0
`microsoft.directory/groups.security/delete`	Group Management	Tier 0
`microsoft.directory/groups.security/dynamicMembershipRule/update`	Group Management	Tier 0
`microsoft.directory/groups.security/members/update`	Group Management	Tier 0
`microsoft.directory/groups.security/owners/update`	Group Management	Tier 0
`microsoft.directory/groups.security/visibility/update`	Group Management	Tier 0
`microsoft.directory/users/basic/update`	Global User Management	Tier 0
`microsoft.directory/users/manager/update`	Global User Management	Tier 0
`microsoft.directory/users/photo/update`	Global User Management	Tier 0
`microsoft.intune/allEntities/allTasks`	Global Endpoint Management	Tier 0
`microsoft.azure.supportTickets/allEntities/allTasks`	Support and Service Health	Tier 1
`microsoft.cloudPC/allEntities/allProperties/allTasks`	User Virtual Endpoint Management	Tier 1
`microsoft.directory/contacts/basic/update`	Microsoft Exchange Online	Tier 1
`microsoft.directory/contacts/create`	Microsoft Exchange Online	Tier 1
`microsoft.directory/contacts/delete`	Microsoft Exchange Online	Tier 1
`microsoft.directory/deviceManagementPolicies/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/deviceRegistrationPolicy/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/groups/hiddenMembers/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.office365.organizationalMessages/allEntities/allProperties/read`	Microsoft 365 Platform Operations	Tier 1
`microsoft.office365.supportTickets/allEntities/allTasks`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.webPortal/allEntities/standard/read`	Microsoft 365 Support Operations	Tier 1

38 de 38 role actions

PowerShell

Get-MgRoleManagementDirectoryRoleDefinition `
  -UnifiedRoleDefinitionId "3a2c62db-5318-420d-8d74-23affee5d9d5"

Microsoft Graph

GET https://graph.microsoft.com/v1.0/
  roleManagement/directory/
  roleDefinitions/3a2c62db-5318-420d-8d74-23affee5d9d5

Ver a documentação oficial na Microsoft Learn

Roles relacionadas

Microsoft Entra Joined Device Local Administrator

Tier 0Device

Cloud Device Administrator

Tier 0Device

Device Managers

Tier 0Device

IoT Device Administrator

Tier 0Device

AI Administrator

Tier 0Microsoft 365