Role-based access control

Use role-based access control in the Microsoft Intune admin center to manage who has access to your organization's resources and what they can do with those resources.

Built-in roles

Windows Autopatch enables role-based access control to use the least privileged access to distribute and delegate Windows Update management in Microsoft Intune.

The permissions defined in Windows Autopatch administrator or Windows Autopatch reader roles are used to manage Autopatch groups, support requests, Autopatch messages, and Autopatch reports.

To manage update policies and Windows Update reports, Device Configuration permission is required. This permission is available in built-in roles such as the Policy and Profile Manager roles.

Policy and Profile Manager roles

Policy and Profile Manager roles include device configuration permissions for managing Intune policies including the following Update policies:

• Update rings
• Quality updates
• Feature updates
• Driver updates

Windows Autopatch Administrator

The Windows Autopatch Administrator role manages all aspects of Windows Autopatch:

• Autopatch groups
• Autopatch reports
  • Quality and feature update status and trending reports
• Support requests and messages

Windows Autopatch Reader

Windows Autopatch Reader can view Windows Autopatch data available in Microsoft Intune but can't make changes.

Update policy roles

To manage Windows quality update, update rings, Windows feature update, driver update, Microsoft 365 Apps, and Microsoft Edge policies the user must have full Device Configuration permissions. The following table is the full list of update management roles:

To successfully manage Windows Autopatch as a lower privilege role, the user must have both Autopatch Admin permissions and the Policy and Profile admin permissions.

Microsoft Entra roles

The following Microsoft Entra roles can access Windows Autopatch features via the Microsoft Intune portal.

Custom roles

You can create two custom roles that include permissions required for a specific job role.

To achieve all-up update management, make sure that the groups assigned to the Autopatch custom role are also a member of the Policy & Profile Manager role or a custom role with equivalent permissions.

Navigate to Tenant Administration > Roles > Create Custom role > Windows Autopatch to create a custom role.

Scopes

Windows Autopatch supports Intune scope tags and scoped groups to be used for distributed update management. Use Microsoft Intune to create and manage scope tags.

• Windows Autopatch supports Intune scope for Autopatch groups, Autopatch role assignments, update policies, and reports.
• Autopatch messages, support, and Admin contacts don't support scopes.
• Autopatch groups created by scoped admins are assigned to the same scope tags as the user.
• Only scoped admins, with the same scope tags assigned to them, can edit and manage Autopatch groups.
• When you create Autopatch groups and assign scope tags, the update policies created inherit the same scope tags.
• The devices assigned to Autopatch groups don't inherit the Autopatch group scope tags. Use Intune to assign scope tag to devices.

Permissions for Autopatch groups

Autopatch groups create Microsoft Entra groups and update policies and assign the policies to the group as part of its workflow. To successfully complete the workflow, both permissions are required. The option to create Autopatch groups is only available when the user has both the permissions enabled.

1. Device Configuration, all permissions
2. Windows Autopatch group, all permissions

Windows Autopatch groups that are assigned scoped tags are only visible to users with those exact scope tags. This ensures the IT admin can manage the ring-based rollouts using Autopatch groups and aren't affected by scope discrepancies.

When the user is assigned scoped groups, they can only assign scoped groups for distribution into deployment rings.

Scoped admins and Autopatch groups

In Intune scoped admins, only an admin user that is assigned specific scope tags and Scoped Groups, can assign policies only to Scoped Groups.

Scoped admins and Autopatch group workflow

As part of the Autopatch group creation workflow, Windows Autopatch creates Microsoft Entra groups and update policies for the selected deployment settings. To assign the update policies to the newly created deployment rings, you must include the Autopatch group as a Scoped Group in the role that contains Device Configuration permissions.

The following table explains the high-level workflow:

Assign scope tags to Autopatch groups

1. In the Microsoft Intune admin center, navigate to Tenant Administration > Autopatch groups > select a group. All rings and policies of the Autopatch group have the same scope.
2. In the Add group to ring option, select the Microsoft Entra groups to be assigned to the Autopatch group. Only groups with scope objects are available for selection.
3. Navigate to Properties > Scope (Tags) > Edit > Select scope tags > select the tags that you want to add to the profile. You can assign a maximum of 100 scope tags to an object.
   1. The Scope Group section is displayed when the service detects Autopatch groups that are created before role-based access controls. This indicates that a Microsoft Entra group is created, which can be added as a Scoped Group. A scoped admin can manage this Autopatch group if included in their scope.
   2. Follow the steps in the Scoped admins and Autopatch group workflow section to assign scoped groups.
4. Select Review + save.

Known issues

Windows 365 Enterprise gives IT admins the option to register devices with Windows Autopatch as part of the Windows 365 provisioning policy creation. You must be an Intune Service administrator to complete this action.

General troubleshooting