# Intune backup Graph permissions | TenuVault Intune backup Graph permissions explained for a delegated app registration. Review documented scopes, admin roles and the separate read-only Backup Reader. Canonical: https://www.tenuvault.com/guides/intune-backup-graph-permissions Practical guide # Intune backup Graph permissions Intune backup Graph permissions depend on the identity and workflow you use. TenuVault's desktop registration uses documented delegated permissions, including write scopes for restore features, while your signed-in admin role limits effective access. The optional Backup Reader is a separate application identity for scheduled read-only backups. [Start with Community](https://www.tenuvault.com/download)[Plans and features](https://www.tenuvault.com/pricing) ## Can I limit access through native Intune roles? Use an Intune role appropriate to the work the administrator performs. An app registration permission and a person's role answer different questions: what the application may request, and what that person may actually do. Review both before approving a backup setup rather than treating consent as the entire access decision. This guide describes the documented TenuVault registration. It does not propose replacing its delegated scopes with an untested set of read-only scopes. If your requirement is an unattended read-only backup identity, evaluate the separate Backup Reader procedure instead of changing the desktop app into a different authentication design. - [Microsoft Learn: Settings Catalog policy export and import](https://learn.microsoft.com/en-us/intune/intune-service/configuration/settings-catalog) ## Which Intune backup Graph permissions are documented? 1\. Review the app-registration permission table with the tenant administrator. The default Graph list includes User.Read for sign-in and the basic profile, Organization.Read.All for organization details, and Policy.Read.All for the optional Conditional Access service. If that service stays off, the documentation permits removing Policy.Read.All when required by your security review. 2\. Review the five delegated write scopes: DeviceManagementConfiguration.ReadWrite.All, DeviceManagementApps.ReadWrite.All, DeviceManagementServiceConfig.ReadWrite.All, DeviceManagementScripts.ReadWrite.All and DeviceManagementRBAC.ReadWrite.All. They support backup and restore of the corresponding configuration, apps, service configuration, scripts and role configuration. Their presence does not mean a read-only Intune administrator can write. 3\. Review DeviceManagementManagedDevices.Read.All. The documented use includes backup of device categories and clean-up rules, plus device count and compliance information in the overview. It is read-only. Include the breadth of information exposed by a scope in the consent review, even when your immediate task is only configuration backup. ## Which optional permissions should I review separately? Group.Read.All is opt-in for checking whether referenced assignment groups exist in hygiene review. Policy.ReadWrite.ConditionalAccess is opt-in for Conditional Access restores. Keep these decisions separate from the baseline desktop setup and document why each optional feature is needed. Mail.Send, GroupMember.Read.All and User.Read.All are optional notification permissions. AuditLog.Read.All is optional for Conditional Access change watching and attribution in reports. These are the optional scopes listed by the app-registration documentation; do not add them just to complete a basic Intune backup. Azure storage access is separate from Graph consent. The documentation lists delegated user\_impersonation for Azure Service Management and Azure Storage, with Storage Blob Data Contributor on the storage account. A successful Graph sign-in alone does not prove that the administrator can use the selected backup location. ## How do I verify the effective setup? 4\. Create the single-tenant public client registration through the documented setup process, obtain the required consent and sign in as the intended backup operator. In Settings, open Services and permissions to inspect backup and restore access for each service. Missing permissions link to the registration for remediation. 5\. After changing consent, use Check again. The service card checks the current sign-in's permissions; roles activated through Privileged Identity Management are not part of that check. Verify the administrator's role separately and run a backup with the intended scope. Review skipped types and failures before accepting the setup. The optional Backup Reader has its own certificate and read-only application scopes. Its baseline list is DeviceManagementConfiguration.Read.All, DeviceManagementApps.Read.All, DeviceManagementServiceConfig.Read.All, DeviceManagementScripts.Read.All and DeviceManagementRBAC.Read.All. DeviceManagementManagedDevices.Read.All and Policy.Read.All are optional there. Desktop restores continue to use the administrator's own sign-in. ## How do I try it on my tenant? Record the consented scopes, intended operator role and selected backup scope, then run a manual backup and inspect its log. Keep the result with the access review. Use the setup and Azure storage guides for the next configuration steps, and recheck permissions when enabling an optional service. - [Review Intune backup scope](https://www.tenuvault.com/intune-backup) - [Prepare the first backup](https://www.tenuvault.com/guides/intune-backup-setup) - [Configure Azure storage access](https://www.tenuvault.com/guides/intune-backup-to-azure-storage) - [Download TenuVault](https://www.tenuvault.com/download) - [Compare plans and features](https://www.tenuvault.com/pricing) ## Read the technical guides - [Intune backup Graph permissions documentation](https://docs.tenuvault.com/security/permissions/) Product scope reviewed 11 November 2026. Check your installed release and the current plan table before using a workflow. ## Frequently asked questions ### Q: Is the desktop app registration read-only? A: No. Its delegated scopes include writes for restore features. Effective access is limited by the signed-in administrator's roles as well as delegated permissions. ### Q: Does basic backup need notification permissions? A: The app-registration documentation marks notification scopes optional. Review them only when enabling the features that use them. ### Q: Is Backup Reader the desktop registration? A: No. It is a separate optional certificate-based application identity for scheduled backups, with documented read-only Graph application scopes. ## Related guides - [back up Intune policies](https://www.tenuvault.com/intune-backup) - [Intune backup retention](https://www.tenuvault.com/guides/intune-backup-retention) - [Set up Intune backups you can verify](https://www.tenuvault.com/guides/intune-backup-setup) - [Intune backup to Azure storage](https://www.tenuvault.com/guides/intune-backup-to-azure-storage) ## Review your setup before the first change Community is free for one tenant. Try Pro free by connecting a new tenant in the app, no email or card needed. Tenant access, supported restore types and scheduling requirements still apply. [Start free trial](https://www.tenuvault.com/trial?src=cta)[Book a 30-minute demo](https://cal.com/ugur-koc/tenuvault-demo)[Permissions and data flows](https://www.tenuvault.com/trust)