Which permissions/roles would I need to have read-only access to all features related to Endpoint(s) on Microsoft Defender?

For read-only access to Endpoint-related features in Microsoft Defender and Intune, the minimum supported combination depends on whether the feature is governed by Defender RBAC, Intune RBAC, or Microsoft Entra roles.

For Endpoint security policies specifically, the current roles listed are not sufficient if the team cannot open Endpoints > Configuration management > Endpoint security policies. That page requires:

1. Permissions that apply to all devices. If the role is scoped only to specific device groups, the Endpoint security policies page can't be opened.
2. One of these permission paths:
   • Microsoft Defender Unified RBAC with Authorization and settings / Security settings / Core Security settings (read) for read-only access to policies
   • Intune RBAC with appropriate endpoint security permissions; Microsoft recommends the built-in Endpoint Security Manager role to align permissions between Intune and the Defender portal
   • Microsoft Entra role membership in Global Administrator, Security Administrator, or Intune Administrator

For a minimum read-only approach, the supported read-only roles from the provided material are:

• Microsoft Defender Unified RBAC: Authorization and settings / Security settings / Core Security settings (read)
• Intune: Read Only Operator provides view-only access to user, device, enrollment, configuration, and application information
• Microsoft Entra: Security Reader provides read access to security-related policies, threats, alerts, and reports, and in Defender for Endpoint it allows viewing and investigating alerts

Important limitation: when Microsoft Defender for Endpoint RBAC is enabled, users with only Microsoft Entra read-only roles such as Security Reader lose access until they are assigned a Defender for Endpoint role.

For endpoint security policies in Intune/Defender integration, Intune RBAC is still required because security settings management through the Defender portal uses the same Intune RBAC permissions. Also, the list of policies shown in the Defender portal is scoped by Intune RBAC assignments.

A practical minimum read-only combination for the scenario described is:

1. Microsoft Defender Unified RBAC with Core Security settings (read)
2. Intune Read Only Operator
3. Ensure the assignment is not limited to specific device groups if access to the page itself is required

If read-only visibility is needed across all endpoint security workloads and reports in Intune, Read Only Operator is the built-in view-only role, but for endpoint security workloads Microsoft documents Endpoint Security Manager, Help Desk Operator, and Read Only Operator as the built-in roles that provide access to endpoint security workloads. Among those, Read Only Operator is the least-privileged read-only option.

If the team still cannot view Endpoint security policies after having Read Only Operator, the likely gap is one of these:

• missing Core Security settings (read) in Defender Unified RBAC
• Intune RBAC assignment is scoped too narrowly
• the tenant is using Defender RBAC and the users were not assigned the corresponding Defender role

For EDR exclusions and similar endpoint configuration items, the same principle applies: visibility is split across Defender and Intune permission models, so a single Entra read-only role alone is not sufficient for all endpoint-related features.

• Manage endpoint security policies in Microsoft Defender for Endpoint
• Manage device security with endpoint security policies in Microsoft Intune
• Assign roles and permissions for Microsoft Defender for Endpoint deployment
• Assign basic permissions for Microsoft Defender for Endpoint portal access
• Microsoft Entra built-in roles
• Role-based access control (RBAC) with Microsoft Intune
• Map existing RBAC permissions to Microsoft Defender unified RBAC permissions