# Verify that an endpoint-security RBAC permission is supported before relying on it

> Can a visible Antivirus permission currently be used to delegate Intune endpoint-security administration?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-187-verify-that-an-endpoint-security-rbac-permission-is-supported-before-relying-on-it/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:31:53+00:00
- Modified: 2026-09-17T16:46:29+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Can a visible Antivirus permission currently be used to delegate Intune endpoint-security administration?

## Potentially affected

Use this check when creating or reviewing an Intune custom administrator role for endpoint-security policy work. Recheck the current workload requirements as Microsoft transitions to more granular permissions.

## DSE recommendation

DSE recommends validating each required administrative action against the documented permission for its exact policy workload.

## Article

## Source facts

Microsoft says endpoint-security workloads currently differ in whether they use granular permissions or the Security baselines permission. The granular Antivirus permission may temporarily appear in some tenants, but Microsoft currently labels it unreleased and unsupported. Microsoft states that Intune ignores configurations of that Antivirus permission. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/device-configuration/endpoint-security/manage-policies).

## Applicability

Use this check when creating or reviewing an Intune custom administrator role for endpoint-security policy work. Recheck the current workload requirements as Microsoft transitions to more granular permissions.

## DSE recommendation

DSE recommends validating each required administrative action against the documented permission for its exact policy workload. Record the current supported permission set in the role design and review release information before adopting a newly visible permission. Assign only the authority required for the approved task, with the intended scope groups and tags.

## Verification

Use a representative delegated test account to exercise the approved read and change actions on a test policy. Compare observed access with the documented workload requirements and intended role scope. If a role depends on the unsupported Antivirus permission, correct that dependency and retest before assigning it to operational administrators.

## Official references

[Microsoft Learn: Manage device security with endpoint security policies in Microsoft Intune](https://learn.microsoft.com/en-us/intune/device-configuration/endpoint-security/manage-policies). Source reviewed September 17, 2026.

## Primary reference

- Name: Manage endpoint security policies in Microsoft Intune - Microsoft Intune | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/intune/device-configuration/endpoint-security/manage-policies
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Verify that an endpoint-security RBAC permission is supported before relying on it,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-187-verify-that-an-endpoint-security-rbac-permission-is-supported-before-relying-on-it/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.