For the complete documentation index, see llms.txt. This page is also available as Markdown.

Available Permissions

Complete reference of the granular permissions you can assign to RealmJoin custom roles, grouped by area.

Overview

This page lists the granular permissions you can assign to Custom Roles, grouped by the area of RealmJoin Portal they apply to.

The definitive, always-current list is shown by the Auto-Complete in the Custom Roles editor. Because RealmJoin's feature set keeps growing, the editor may occasionally offer a permission that is newer than this page.

Permissions build on each other. A permission that shows or changes details usually also requires the matching read permission (for example, changing a setting requires being able to see it first). Where a specific prerequisite applies, it is noted in the Requires column.

Settings & Administration

Permission
Requires
Description

CanReadSettingsDetails

Access the Settings area.

CanChangeTenantSettings

CanReadSettingsDetails

Modify tenant-wide settings.

CanReadOrganizationFeatures

View the tenant's enabled RealmJoin features.

CanEditOrganizationFeatures

CanReadOrganizationFeatures

Enable or disable RealmJoin features for the tenant.

CanEditTenantLaMetricSecret

Manage the secret for the LaMetric Time integration.

App Management

Permission
Requires
Description

CanReadAppTable

Read access to Package Management (the package list). Does not grant access to package details.

CanReadIntuneAppDetails

CanReadAppTable

Read-only access to Intune package details.

CanReadRealmJoinAppDetails

CanReadAppTable

Read-only access to RealmJoin Client package details.

CanChangeAppAssignments

Package details access

Add or remove user/group assignments on a package.

CanSeeAppAssignmentSettings

Package details access

See the per-assignment settings of a RealmJoin Client package.

CanChangeAppAssignmentSettings

CanSeeAppAssignmentSettings

Modify the per-assignment settings of a RealmJoin Client package.

CanSeeAppExpertSettings

Package details access

See an app's expert settings.

CanEditAppExpertSettings

CanSeeAppExpertSettings

Modify an app's expert settings.

CanEditAppSettings

Package details access

Modify an app's general settings.

CanEditAppAutomation

Package details access

Modify an app's automation (if/when newer store versions roll out automatically).

CanEditAppDisplayName

Package details access

Modify an app's display name.

CanEditAppTechnicalApplicationOwners

Package details access

Modify an app's Technical Application Owners in Config.

CanEnableAppUpdateGroup

Package details access

Enable or disable a package's update group.

CanUpgradeApp

Package details access

Trigger an upgrade of a package to a newer version.

CanSubscribeApp

CanReadPackageStoreDetails

Subscribe to an offering from the Package Store.

CanDeleteApp

Package details access

Delete an app from Package Management. Does not remove it from the store or uninstall existing deployments.

CanSeeSoftwareSecurityVulnerabilities

See known security vulnerabilities for software.

CanSeeIntuneAppJson, CanSeeIntuneAppStoreJson, CanSeeRealmJoinAppJson, CanSeeRealmJoinAppStoreJson

See diagnostic JSON for a package in Package Store or Package Management. Only shown when Show advanced info is enabled in Settings.

Package Store

Permission
Requires
Description

CanReadPackageStoreTable

Access the Package Store list. Does not grant access to details or the ability to subscribe.

CanReadPackageStoreDetails

CanReadPackageStoreTable

Inspect a package store offering. Does not grant the ability to subscribe.

Software Requests

Permission
Requires
Description

CanRequestSoftware

Submit a software packaging request to RealmJoin. Combine with CanRequestSoftwarePaas or CanRequestSoftwareOrganic.

CanRequestSoftwarePaas

Request a package to be produced by RealmJoin and made available in the Package Store.

CanRequestSoftwareOrganic

Submit an "organic" package (raw, untested setup) for distribution via RealmJoin Client.

App Categories

Permission
Requires
Description

CanReadAppCategories

View the tenant's Intune app categories.

CanEditAppCategories

CanReadAppCategories

Create, edit and delete Intune app categories.

Software Report

Permission
Requires
Description

CanReadSoftwareReportTable

Access the Software Report list.

CanReadSoftwareReportDetails

CanReadSoftwareReportTable

Inspect Software Report details.

User Management

Permission
Requires
Description

CanReadUserTable

See the list of all Entra ID users.

CanReadUserDetails

Inspect an individual user's details.

CanSeeRealmJoinUserSettings

CanReadUserDetails

See the RealmJoin Client settings assigned to a user.

CanChangeRealmJoinUserSettings

CanSeeRealmJoinUserSettings

Add, modify or delete the RealmJoin Client settings assigned to a user.

CanReadUserSettingTable

See the list of user settings across all users.

CanReadUserSettingDetails

Reserved — registered but not currently surfaced in the Portal.

CanSeeUserJsonAzureAD, CanSeeUserJsonRealmJoin

CanReadUserDetails

See diagnostic JSON tabs for a user. Only shown when Show advanced info is enabled in Settings.

CanSeeUserSignIns

CanReadUserDetails

See Microsoft Entra sign-in information for a user.

Group Management

Permission
Requires
Description

CanReadGroupTable

See the list of all Entra ID and RealmJoin internal groups.

CanReadGroupDetails

Inspect an individual group's details.

CanChangeGroupMembers

CanReadGroupDetails

Add or remove group members.

CanEditGroupDisplayName

CanReadGroupDetails

Change a group's display name.

CanDeleteGroup

CanReadGroupDetails

Delete a group.

CanSeeRealmJoinGroupSettings

CanReadGroupDetails

See the RealmJoin Client settings assigned to a group.

CanChangeRealmJoinGroupSettings

CanSeeRealmJoinGroupSettings

Add, modify or delete the RealmJoin Client settings assigned to a group.

CanReadGroupSettingTable

See the list of group settings across all groups.

CanReadGroupSettingDetails

Reserved — registered but not currently surfaced in the Portal.

CanSeeGroupJsonAzureAD, CanSeeGroupJsonRealmJoin

CanReadGroupDetails

See diagnostic JSON for a group. Only shown when Show advanced info is enabled in Settings.

CanSeeOwnGroups

Allow a (non-external) user to see the groups and teams they are a member of.

Device Management

Actions and operations on devices from Device Details.

Permission
Requires
Description

CanReadDeviceTable

See the list of all Entra ID devices.

CanReadDeviceDetails

Inspect an individual device's details.

CanSyncDevice

Trigger an Intune sync for a managed Windows device.

CanScanDevice

Trigger a Defender for Endpoint scan for a Windows device.

CanRequestDeviceLogs

Trigger collection of "Extended Logs" for a device via RealmJoin Client.

CanChangeRealmJoinPrimaryUser

Assign a different primary user in RealmJoin.

CanRotateIntuneManagedDeviceLocalCredentials

Rotate the Intune-managed local administrator (Windows LAPS) credentials of a device.

CanRotateRecoveryKeys

Rotate a device's disk-encryption recovery key (BitLocker on Windows, FileVault on macOS).

CanUseDeviceAnyDeskInterface

Connect to a device using AnyDesk AnyConnect from RealmJoin Portal.

Device Information

Individual information panels/tabs shown on Device Details.

Permission
Requires
Description

CanSeeDeviceHardwareInformation

See a device's hardware information.

CanSeeDeviceIdentifierInformation

See a device's identifiers.

CanSeeDeviceGroups

See the groups a device is a member of.

CanSeeDeviceRealmJoinInformation

See RealmJoin Client details for a device.

CanSeeDeviceNetworkInformation

See network information for a device, including Delivery Optimization data if available.

CanSeeDeviceUsers

See the device's logged-on user. (Without it, users who can see device details can still see the device owner.)

CanSeeDeviceAutopilotInformation

See a device's Autopilot information (if present).

CanSeeDeviceSoftwarePackagesInstalled

See the software packages installed on a device.

CanSeeDeviceSafeguardHold

See Safeguard Holds that prevent a Windows feature update.

CanSeeWindowsDeviceUpdatesEnrollmentState

See a Windows device's update (Windows Update for Business) enrollment state.

CanSeeDeviceIntuneManagedLapsStatus

See the Intune-managed LAPS status of a device.

CanSeeWarranty

Use the Warranty tab for a device.

CanSeeDeviceExternalLinks

See links to Intune, Microsoft Entra, etc. for a device.

CanSeeUserAppCatalog

See the App Catalog tab for a Windows device.

CanEndUserSeeDeviceStorageInformation

Allow an end user to see storage information for their own device.

CanSeeDeviceJsonAtp, CanSeeDeviceJsonAutopilot, CanSeeDeviceJsonAzureAD, CanSeeDeviceJsonIntune, CanSeeDeviceJsonRealmJoin

See diagnostic JSON tabs for a device. Only shown when Show advanced info is enabled in Settings.

Device Security

Permission
Requires
Description

CanSeeDeviceSecurityInformation

See a device's security state, especially device compliance.

CanSeeDeviceExtendedSecurityInformation

See extended security info from Defender for Endpoint (if available).

CanSeeDeviceSecurityRecommendations

See Microsoft Security Center recommendations for a device.

CanSeeDeviceSecurityVulnerabilities

See Microsoft Security Center vulnerabilities for a device.

CanSeeDeviceSecurityAlerts

See security alerts for a device.

CanSeeBitLockerKeys

View a device's BitLocker recovery keys.

CanSeeRecoveryKeys

View a device's disk-encryption recovery keys (BitLocker/FileVault).

Organization

Permission
Requires
Description

CanReadOrganizationDetails

See the Organization details.

CanSeeOrganizationJsonAzureAD

See organization diagnostic JSON. Only shown when Show advanced info is enabled in Settings.

Self Service Forms

Permission
Requires
Description

CanReadSelfServiceFormsHistoryTable

See the list of recent Self Service Forms submissions.

CanReadSelfServiceFormsHistoryDetails

Inspect individual Self Service Forms submissions.

CanSeeSelfServiceForms

See the configured Self Service Forms.

CanAddSelfServiceForms

Settings access

Create new Self Service Forms.

CanEditSelfServiceForms

Settings access

Edit existing Self Service Forms.

CanDeleteSelfServiceForms

Settings access

Delete Self Service Forms.

Runbooks

Permission
Requires
Description

CanSeeRunbooks

See the list of available runbooks (limited by object types the user can see and by Runbook Permissions). Does not allow starting jobs.

CanRunRunbooks

CanSeeRunbooks

Start runbook jobs.

CanEditRunbookSchedules

CanSeeRunbooks

Create and manage runbook schedules.

CanApproveRunbookExecution

Approve runbook executions that require approval.

CanSyncRunbooksWithUpstream

Settings access

Sync runbooks from RealmJoin's shared repository.

Runbook Logs

Permission
Requires
Description

CanReadRunbookTable

See the Runbook Logs list.

CanReadRunbookDetails

CanReadRunbookTable

Inspect a Runbook Logs item and its output.

Remediation Scripts

Permission
Requires
Description

CanSeeRemediationScripts

See the remediation scripts.

CanRunRemediationScripts

CanSeeRemediationScripts

Run proactive remediation scripts.

Device Health Scripts

Manage Intune remediation / device health scripts.

Permission
Requires
Description

CanReadDeviceHealthScriptsTable

See the list of device health scripts.

CanReadDeviceHealthScriptsDetails

CanReadDeviceHealthScriptsTable

Inspect a device health script.

CanStageDeviceHealthScripts

Stage / import device health scripts.

CanAssignDeviceHealthScripts

Assign device health scripts to groups.

CanScheduleDeviceHealthScripts

Schedule device health scripts.

CanDeleteDeviceHealthScripts

Delete device health scripts.

Notifications

Permission
Requires
Description

CanReadNotificationTable

See the list of notifications.

CanReadNotificationDetails

CanReadNotificationTable

Inspect a notification.

Templates

Permission
Requires
Description

CanReadTemplateTable

See the list of templates.

CanReadTemplateDetails

CanReadTemplateTable

Inspect a template.

CanEditTemplate

Edit a template.

CanDeleteTemplate

Delete a template.

CanChangeTemplatePackages

Change the packages contained in a template.

CanChangeTemplateTokens

Change a template's tokens.

Changelog

The changelog is the change/version history of an object, shown as a Changelog tab on its detail page.

Permission
Requires
Description

CanSeeChangelog

See the changelog (change/version history) tab on an object's detail page — labeled History on RealmJoin apps and Versions in the Package Store, and available on Device, User, Group and Organization details.

CanReadChangelogTable

Reserved — registered but not currently surfaced in the Portal.

CanReadChangelogDetails

Reserved — registered but not currently surfaced in the Portal.

Profiles

Permission
Requires
Description

CanReadProfileTable

Reserved — registered but not currently surfaced in the Portal.

CanReadProfileDetails

Reserved — registered but not currently surfaced in the Portal.

Operations

Permission
Requires
Description

CanReadOperationsTable

See the operations list. (Currently a preview feature.)

CanReadOperationsDetails

Reserved — registered but not currently surfaced in the Portal.

Networks & Delivery Optimization

Permission
Requires
Description

CanReadNetworksTable

See the networks list. (Currently a preview feature.)

CanReadDONetworkTable

Reserved — registered but not currently surfaced in the Portal.

CanReadDONetworkDetails

Reserved — registered but not currently surfaced in the Portal.

Logs

Permission
Requires
Description

CanReadLogsTable

See the audit/log list.

CanReadLogDetails

CanReadLogsTable

Inspect a log entry.

Data Export

Permission
Requires
Description

CanReadExportsTable

Access the Data Export page and download predefined exports.

Workplace Cloud Storage

See, upload/edit and delete the different areas of Workplace Cloud Storage.

Permission
Requires
Description

CanReadFavoritesTable

View the Favorites list.

CanReadFavoritesDetails

CanReadFavoritesTable

Inspect Favorites details.

CanEditFavorites

Edit Favorites.

CanDeleteFavorites

Delete Favorites.

CanSeeOrganizationBackgroundFiles

View background image files.

CanUploadOrganizationBackgroundFiles

Upload background image files.

CanDeleteOrganizationBackgroundFiles

Delete background image files.

CanSeeOrganizationSignatureFiles

View e-mail signature files.

CanEditOrganizationSignatureFiles

Edit e-mail signature files.

CanDeleteOrganizationSignatureFiles

Delete e-mail signature files.

CanSeeOrganizationOtherFiles

View other organization files.

CanUploadOrganizationOtherFiles

Upload other organization files.

CanDeleteOrganizationOtherFiles

Delete other organization files.

Last updated

Was this helpful?