Forum Discussion
Edit Policy Permission Issue in MDE Portal
Dear All,
We are facing an issue with permission assignments in the MDE portal.
We assigned the following permissions to the account (e.g., email address removed for privacy reasons):
- MDE Portal: Under Settings > Endpoints > Permissions > Roles, we added a role with all permissions except Live Response.
- Intune: Assigned the Read Only Operator role.
However, when logging in with this account, it cannot save policies such as ASR and Antivirus policies. The following error appears:
"Access needed: You don’t have the right permissions in Intune to create/edit this information. To adjust your permissions, go to the Intune portal."
Could someone advise on the required permissions to enable policy creation/editing?
Thanks.
7 Replies
I believe the Intune roles prevail from what is customized in MDE, as MDE specific/custom roles are limited for device grouping and what activities can be restricted within MDE (alerts, incidents, vuln mgmt, etc) [1]. Because the Intune policies are assigned from Intune, the Intune roles prevail. Recommend to allow 'Security Admin' which allows Read Only permission to all Intune, except admin rights to endpoint security node [2]
[1] https://learn.microsoft.com/en-us/defender-endpoint/user-roles
[2] https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control
To fix this, you need to give the account a higher role in Intune, such as Intune Administrator, Security Administrator, or Endpoint Security Manager. These roles allow managing and updating security policies. You can change the role in Microsoft Azure ID Roles & Administrators or Intune Admin Center Tenant Administration Roles. After assigning the correct role, the account should be able to save policies without any issues.
Have you tried assign more Intune permissions to the account? When MDE is integrated with Intune, endpoint security policies are managed in Intune. These policies are configured in the Intune admin center and enforced via MDE, meaning you need more Intune permissions than Read Only Operator to create them.
Hello saulov8
Thanks for your response.
I've created an Intune custom role with permissions for ASR, and the user can now edit/create ASR policies. Could you confirm which permissions are needed for other policies like Antivirus, Windows Security Experience, etc.?
Thanks
Maybe try the Endpoint Security Manager role
