Documented Graph API Permissions?

[humphreysl]

Is it documented precisely anywhere which specific API Permissions are needed for these Cmdlets to run?

Do the necessary Permissions need to be ReadWrite or can they just be Read?

[JakeMoe]

In IntuneBackupAndRestore/Public/Start-IntuneBackup.ps1, you can see:

connect-mggraph -scopes "EntitlementManagement.ReadWrite.All, DeviceManagementApps.ReadWrite.All, DeviceManagementConfiguration.ReadWrite.All, DeviceManagementServiceConfig.ReadWrite.All, DeviceManagementManagedDevices.ReadWrite.All, DeviceManagementScripts.ReadWrite.All"

Those would be the scopes needed. And as they're coded to check for "ReadWrite" rather than just "Read", the scripts won't run without it. I presume you were thinking of only using the backup functionality?