{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-187-verify-that-an-endpoint-security-rbac-permission-is-supported-before-relying-on-it/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-187-verify-that-an-endpoint-security-rbac-permission-is-supported-before-relying-on-it/", "slug": "dse-20260917-187-verify-that-an-endpoint-security-rbac-permission-is-supported-before-relying-on-it", "url": "https://update.dsesecurity.com/updates/dse-20260917-187-verify-that-an-endpoint-security-rbac-permission-is-supported-before-relying-on-it/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-187-verify-that-an-endpoint-security-rbac-permission-is-supported-before-relying-on-it.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-187-verify-that-an-endpoint-security-rbac-permission-is-supported-before-relying-on-it/" }, "title": "Verify that an endpoint-security RBAC permission is supported before relying on it", "summary": "Can a visible Antivirus permission currently be used to delegate Intune endpoint-security administration?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:31:53+00:00", "modified_at": "2026-09-17T16:46:29+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 200, "potentially_affected": "Use this check when creating or reviewing an Intune custom administrator role for endpoint-security policy work. Recheck the current workload requirements as Microsoft transitions to more granular permissions.", "dse_recommendation": "DSE recommends validating each required administrative action against the documented permission for its exact policy workload.", "primary_source": { "name": "Manage endpoint security policies in Microsoft Intune - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/device-configuration/endpoint-security/manage-policies", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft says endpoint-security workloads currently differ in whether they use granular permissions or the Security baselines permission. The granular Antivirus permission may temporarily appear in some tenants, but Microsoft currently labels it unreleased and unsupported. Microsoft states that Intune ignores configurations of that Antivirus permission. Microsoft Learn.

\n

Applicability

\n

Use this check when creating or reviewing an Intune custom administrator role for endpoint-security policy work. Recheck the current workload requirements as Microsoft transitions to more granular permissions.

\n

DSE recommendation

\n

DSE recommends validating each required administrative action against the documented permission for its exact policy workload. Record the current supported permission set in the role design and review release information before adopting a newly visible permission. Assign only the authority required for the approved task, with the intended scope groups and tags.

\n

Verification

\n

Use a representative delegated test account to exercise the approved read and change actions on a test policy. Compare observed access with the documented workload requirements and intended role scope. If a role depends on the unsupported Antivirus permission, correct that dependency and retest before assigning it to operational administrators.

\n

Official references

\n

Microsoft Learn: Manage device security with endpoint security policies in Microsoft Intune. Source reviewed September 17, 2026.

", "content_text": "Source facts\nMicrosoft says endpoint-security workloads currently differ in whether they use granular permissions or the Security baselines permission. The granular Antivirus permission may temporarily appear in some tenants, but Microsoft currently labels it unreleased and unsupported. Microsoft states that Intune ignores configurations of that Antivirus permission. Microsoft Learn.\nApplicability\nUse this check when creating or reviewing an Intune custom administrator role for endpoint-security policy work. Recheck the current workload requirements as Microsoft transitions to more granular permissions.\nDSE recommendation\nDSE recommends validating each required administrative action against the documented permission for its exact policy workload. Record the current supported permission set in the role design and review release information before adopting a newly visible permission. Assign only the authority required for the approved task, with the intended scope groups and tags.\nVerification\nUse a representative delegated test account to exercise the approved read and change actions on a test policy. Compare observed access with the documented workload requirements and intended role scope. If a role depends on the unsupported Antivirus permission, correct that dependency and retest before assigning it to operational administrators.\nOfficial references\nMicrosoft Learn: Manage device security with endpoint security policies in Microsoft Intune. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nMicrosoft says endpoint-security workloads currently differ in whether they use granular permissions or the Security baselines permission. The granular Antivirus permission may temporarily appear in some tenants, but Microsoft currently labels it unreleased and unsupported. Microsoft states that Intune ignores configurations of that Antivirus permission. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/device-configuration/endpoint-security/manage-policies).\n\n## Applicability\n\nUse this check when creating or reviewing an Intune custom administrator role for endpoint-security policy work. Recheck the current workload requirements as Microsoft transitions to more granular permissions.\n\n## DSE recommendation\n\nDSE recommends validating each required administrative action against the documented permission for its exact policy workload. Record the current supported permission set in the role design and review release information before adopting a newly visible permission. Assign only the authority required for the approved task, with the intended scope groups and tags.\n\n## Verification\n\nUse a representative delegated test account to exercise the approved read and change actions on a test policy. Compare observed access with the documented workload requirements and intended role scope. If a role depends on the unsupported Antivirus permission, correct that dependency and retest before assigning it to operational administrators.\n\n## Official references\n\n[Microsoft Learn: Manage device security with endpoint security policies in Microsoft Intune](https://learn.microsoft.com/en-us/intune/device-configuration/endpoint-security/manage-policies). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-187-verify-that-an-endpoint-security-rbac-permission-is-supported-before-relying-on-it/", "url": "https://update.dsesecurity.com/updates/dse-20260917-187-verify-that-an-endpoint-security-rbac-permission-is-supported-before-relying-on-it/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-187-verify-that-an-endpoint-security-rbac-permission-is-supported-before-relying-on-it/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Verify that an endpoint-security RBAC permission is supported before relying on it", "item": "https://update.dsesecurity.com/updates/dse-20260917-187-verify-that-an-endpoint-security-rbac-permission-is-supported-before-relying-on-it/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-187-verify-that-an-endpoint-security-rbac-permission-is-supported-before-relying-on-it/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-187-verify-that-an-endpoint-security-rbac-permission-is-supported-before-relying-on-it/", "url": "https://update.dsesecurity.com/updates/dse-20260917-187-verify-that-an-endpoint-security-rbac-permission-is-supported-before-relying-on-it/", "headline": "Verify that an endpoint-security RBAC permission is supported before relying on it", "description": "Can a visible Antivirus permission currently be used to delegate Intune endpoint-security administration?", "abstract": "Can a visible Antivirus permission currently be used to delegate Intune endpoint-security administration?", "articleBody": "Source facts\nMicrosoft says endpoint-security workloads currently differ in whether they use granular permissions or the Security baselines permission. The granular Antivirus permission may temporarily appear in some tenants, but Microsoft currently labels it unreleased and unsupported. Microsoft states that Intune ignores configurations of that Antivirus permission. Microsoft Learn.\nApplicability\nUse this check when creating or reviewing an Intune custom administrator role for endpoint-security policy work. Recheck the current workload requirements as Microsoft transitions to more granular permissions.\nDSE recommendation\nDSE recommends validating each required administrative action against the documented permission for its exact policy workload. Record the current supported permission set in the role design and review release information before adopting a newly visible permission. Assign only the authority required for the approved task, with the intended scope groups and tags.\nVerification\nUse a representative delegated test account to exercise the approved read and change actions on a test policy. Compare observed access with the documented workload requirements and intended role scope. If a role depends on the unsupported Antivirus permission, correct that dependency and retest before assigning it to operational administrators.\nOfficial references\nMicrosoft Learn: Manage device security with endpoint security policies in Microsoft Intune. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:31:53+00:00", "dateModified": "2026-09-17T16:46:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-187-verify-that-an-endpoint-security-rbac-permission-is-supported-before-relying-on-it/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-187-verify-that-an-endpoint-security-rbac-permission-is-supported-before-relying-on-it/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Verify that an endpoint-security RBAC permission is supported before relying on it" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 200, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Manage endpoint security policies in Microsoft Intune - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/device-configuration/endpoint-security/manage-policies" } } ] } }