Lesson 2: Who Can Do What: The Smallest Role for Each Job

Why this matters on day one

Every ticket in this course ends with you doing something in a console, such as syncing a laptop, resetting a password or deleting a stale device record. Each of those actions needs a permission. The tempting shortcut is to give the whole help desk Global Administrator. It works, and it is wrong. Global Administrator can do everything in Entra ID and in every Microsoft service that uses Entra identities. A phished help desk account then becomes a phished tenant. Microsoft's own guidance says to keep Global Administrators to fewer than five.

Think of it like the keys in an office building. The cleaner has a key to every floor but not to the server room. The facilities manager has the server room key but no access to payroll. Each person gets the smallest key ring that lets them do their job. In this lesson you build that key ring for device support.

Note: this course is independent of Microsoft. Role names and permissions below were checked against Microsoft's documentation on 2 November 2026. Microsoft does change them, so recheck before you rely on them.

Two separate role systems

The most common source of confusion is that there are two different places where roles live.

Two Entra roles span both worlds. Intune Administrator is an Entra role that "can manage all aspects of the Intune product", and Global Administrator covers everything. Both are far broader than help desk work needs.

Gotcha: a laptop has a record in Entra ID (its identity) and a separate record in Intune (its management). The two records need different permissions. Cloud Device Administrator can enable, disable and delete the Entra device object, but Microsoft states it cannot manage devices through Intune.

The job-to-role map

This is the core of the lesson. Pin it next to your queue.

JOB                                         SMALLEST BUILT-IN ROLE            SYSTEM
------------------------------------------  --------------------------------  ------
Look at a device, its compliance, its apps  Read Only Operator                Intune
Sync, restart, remote lock, retire, wipe    Help Desk Operator                Intune
Remote Help (view screen / take control)    Help Desk Operator                Intune
Change a device's primary user              Help Desk Operator                Intune
Reset a non-admin user's password           Helpdesk Administrator            Entra
Read a BitLocker recovery key               Helpdesk Administrator            Entra
                                            (or Cloud Device Administrator)
Enable / disable / delete the Entra         Cloud Device Administrator        Entra
  device object
Delete the *Intune* managed-device record   NOT Help Desk Operator - see note Intune

Three points that trip people up:

1. Help Desk Operator can wipe but cannot delete. Its permissions include the Wipe and Retire remote tasks, but not Managed devices: Delete. Among built-in Intune roles, Delete sits in broader roles such as Endpoint Security Manager and School Administrator. The usual answer is a custom role with that one extra permission, or escalation. Don't ask for a big role to get one button.
2. Helpdesk Administrator has limits on whose passwords it can reset. It can reset non-administrators and a short list of low roles: Directory Readers, Guest Inviter, Helpdesk Administrator, Message Center Reader, Password Administrator and Reports Reader. It cannot reset an Intune Administrator or a Global Administrator, and that is by design. Password Administrator is even narrower. It resets non-admins, Directory Readers, Guest Inviters and other Password Administrators, and it cannot read BitLocker keys.
3. Read Only Operator really is read-only. Microsoft's description is that it "cannot make changes to Intune". That makes it the safe default for first line staff and new starters.

Best practice: for anything sensitive, a first-line analyst might hold Read Only Operator permanently and request more through PIM (next section). An approval step on a wipe is a feature.

Check what you hold, read-only

Before you open a ticket saying "I can't sync this device", find out what your account actually has.

In the Intune admin center:

Tenant administration > Roles > My permissions
# Shows one combined list of every Intune permission you hold,
# whether the role was assigned to you directly or through a group.

In the Entra admin center (directory roles and PIM):

ID Governance > Privileged Identity Management > My roles > Microsoft Entra roles
# Eligible assignments = you CAN activate it, but you don't hold it right now
# Active assignments   = you hold it now (permanently, or for a time-limited window)

With Microsoft Graph PowerShell (read-only scopes only):

# Read-only consent: we only want to look
Connect-MgGraph -Scopes "RoleManagement.Read.Directory","User.Read"

# Your own object ID
$me = (Get-MgContext).Account
$id = (Get-MgUser -UserId $me).Id

# Roles you hold right now (active)
Get-MgRoleManagementDirectoryRoleAssignment -Filter "principalId eq '$id'" `
  -ExpandProperty RoleDefinition |
  Select-Object @{n='Role';e={$_.RoleDefinition.DisplayName}}, DirectoryScopeId

# Roles you could activate through PIM (eligible)
Get-MgRoleManagementDirectoryRoleEligibilitySchedule -Filter "principalId eq '$id'" `
  -ExpandProperty RoleDefinition |
  Select-Object @{n='Role';e={$_.RoleDefinition.DisplayName}}, Status

Example output for a well-set-up second-line engineer:

Role                     DirectoryScopeId
----                     ----------------
Helpdesk Administrator   /

Role                        Status
----                        ------
Cloud Device Administrator  Provisioned

In plain terms, this engineer can reset passwords and read BitLocker keys at any time. They must activate Cloud Device Administrator before deleting an Entra device object.

Gotcha: if you were made eligible through a group, the Graph eligibility query above won't list it. The PIM My roles page is the more reliable view.

Eligible vs permanent, and why the delay

With PIM, an eligible role does nothing until you activate it. You give a reason, you may need to pass MFA, and an approver may have to agree. The role then becomes active for a set period. PIM adds the active assignment within seconds. Some admin portals cache your old permissions, though, so if a button stays greyed out, sign out and back in before assuming the activation failed. Activation also shows up in audit logs. That protects you: when someone asks who wiped a laptop, the log shows the ticket reason you entered.

If your tenant has no PIM, every assignment is permanent. That is one more reason to keep the roles small.

Key takeaways

• Entra roles cover identities, passwords, device objects and BitLocker keys. Intune roles cover managed devices, apps and remote actions. Learn which system a job lives in.
• These are the smallest built-in roles for each job: Read Only Operator to look, Help Desk Operator for remote actions including Remote Help, Helpdesk Administrator for non-admin password resets and BitLocker keys, and Cloud Device Administrator for the Entra device object.
• Help Desk Operator can wipe but cannot delete the Intune device record.
• Global Administrator is the wrong answer for help desk work because it can do everything everywhere. Keep it rare.
• Check your own access in Tenant administration > Roles > My permissions (Intune) and PIM > My roles (Entra). Eligible means you must activate before you act.