Apologies, I read your question as read-only, not sure about access for just app readiness. 

I had to open an MS ticket to find this out, but you want both "Endpoint Analytics - Read," and "Organization - Read" in Tenant administration > Roles > Create > Intune Role. Don't forget to use scope tags https://docs.microsoft.com/en-us/mem/intune/fundamentals/scope-tags if you want to limit the access to a subset of devices.