Verify that an endpoint-security RBAC permission is supported before relying on it

Source facts

Microsoft says endpoint-security workloads currently differ in whether they use granular permissions or the Security baselines permission. The granular Antivirus permission may temporarily appear in some tenants, but Microsoft currently labels it unreleased and unsupported. Microsoft states that Intune ignores configurations of that Antivirus permission. Microsoft Learn.

Applicability

Use this check when creating or reviewing an Intune custom administrator role for endpoint-security policy work. Recheck the current workload requirements as Microsoft transitions to more granular permissions.

DSE recommendation

DSE recommends validating each required administrative action against the documented permission for its exact policy workload. Record the current supported permission set in the role design and review release information before adopting a newly visible permission. Assign only the authority required for the approved task, with the intended scope groups and tags.

Verification

Use a representative delegated test account to exercise the approved read and change actions on a test policy. Compare observed access with the documented workload requirements and intended role scope. If a role depends on the unsupported Antivirus permission, correct that dependency and retest before assigning it to operational administrators.

Official references

Microsoft Learn: Manage device security with endpoint security policies in Microsoft Intune. Source reviewed September 17, 2026.