Hi Chris - there are a few options for you. In addition to the Intune Administrator role, you can also use the Policy and Profile Manager Role in Intune for managing Windows Updates. Beyond the Intune Administrator and Policy and/or Profile Manager Role for managing updates, we also recommend using Endpoint Analytics to determine device eligibility. The permissions for Endpoint Analytics are available here: https://docs.microsoft.com/en-us/mem/analytics/overview#permissions Since you asked about all tools, I will also mention that if your team wants to use the Windows Update for Business deployment service directly, you can use the Windows Update Deployment Administrator in Azure Active Directory (though this does not apply within Endpoint Manager). Hope this helps!