Microsoft Entra ID · Developer & Technical
Desktop Analytics Administrator
Can access and manage Desktop management tools and services for Windows device analytics.
Scope: Desktop Analytics configuration and Windows device management insights
Permissions
- Access Desktop Analytics service
- Manage Desktop Analytics settings
- View device compatibility data
- Create deployment plans
- View deployment readiness
- Manage update insights
Common use cases
- Windows upgrade planning
- Application compatibility assessment
- Deployment readiness analysis
- Update compliance monitoring
- Device inventory insights
Best practices
- Define deployment ring strategy
- Review compatibility data before upgrades
- Monitor update compliance
- Document upgrade decisions
- Coordinate with desktop support
Security considerations
- Device data may reveal security posture
- Deployment decisions affect security updates
- Monitor for out-of-date devices
Common questions
When should I assign the Desktop Analytics Administrator role?
Assign Desktop Analytics Administrator when you need to: Windows upgrade planning; Application compatibility assessment; Deployment readiness analysis; Update compliance monitoring; and Device inventory insights. It is part of Microsoft Entra ID and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Desktop Analytics Administrator role do?
The Desktop Analytics Administrator role grants permissions including: Access Desktop Analytics service; Manage Desktop Analytics settings; View device compatibility data; Create deployment plans; View deployment readiness; and Manage update insights. See the Permissions section above for the full list.
What are the security risks of the Desktop Analytics Administrator role?
Key considerations when assigning Desktop Analytics Administrator: Device data may reveal security posture; Deployment decisions affect security updates; and Monitor for out-of-date devices. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.