Microsoft Intune/Azure permissions for the Portnox Cloud app

In this topic, you will learn what minimum permissions are needed in Microsoft Intune and Azure for the Portnox™ Cloud app to work correctly.

Microsoft Azure:

  • AzureApplication.Read.All: Required for the app to perform SCEP validations.

  • Device.Read.All: Required for the app to get the following variables: Id, DisplayName, DeviceId, DeviceVersion, IsCompliant, IsManaged, OperatingSystem, OperatingSystemVersion, Model, Manufacturer, Imei, Meid, SerialNumber, MacAddress.

  • DeviceManagementManagedDevices.Read.All: Required for the app to reference the Azure device ids from the Intune device ids.

  • Group.Read.All: Required for the app to get the following variables: Id, MailNickname, Description, DisplayName, MemberOf, Members.

  • ServicePrincipalEndpoint.Read.All: Required for the app to get a list of Intune endpoints in the tenant’s Azure directory.

  • User.Read.All: Required for the app to get the following variables: Id, UserPrincipalName, Mail, MailNickname, AccountEnabled, DeviceOwners, DeviceUsers.

Microsoft Intune:

  • scep_challenge_provider: Required only if you use SCEP. It lets the Portnox Cloud service validate that SCEP requests originated from Intune.

  • get_device_compliance: Required to allow the app to find Intune devices by their MAC address.