# Set Up Intune Permissions for CustomApps Upload

> Set up the Intune permissions CapaOne needs before you can upload a CustomApp to Intune.

Source: https://docs.capaone.com/capaone/integrations/setup-intune-permissions-for-customapps-upload/  
Product: CapaOne — a separate CapaSystems product; do not apply this page to any other.

To upload a CapaOne CustomApp to Intune, you will need to set up the required permissions in Intune. In this guide, we will show you how to achieve this.

:::note[Important]
The tenant must have an active **Intune Subscription**. Trying to upload to Intune without a subscription will fail with the error:

*“Missing required permission”: DeviceManagementApps.ReadWrite.All“*
:::

## Before you get started

Make sure you have an Azure AD Integration setup in Intune and CapaOne. If not, you can follow this guide on how to set up the Integration: [Integrate CapaOne with Entra ID](/capaone/integrations/integrate-capaone-with-entra-id/)

## Configure Intune permissions

1. **Log in to the** **Azure Portal**

   - Navigate to <https://portal.azure.com/> and log in to your account.
2. **Navigate to App Registrations**

   - In the left menu, select **Azure Active Directory**
   - Click on **App registrations**
3. **Select or Create an Application**

   - Choose an existing app registration, or
   - Click **New registration** to create a new app

![App registrations page with an existing app or the New registration button](/attachments/capaone/bc4bc85e-e6a8-4454-a1eb-40fad3356f33.png)

4. **Configure API Permissions**

   - In your app registration, go to **Manage > API permissions**
   - Click **Add a permission**

![App registration API permissions page with the Add a permission button](/attachments/capaone/9c21c50b-a3ef-47e7-9a37-df8211205e31.png)

5. **Add Required Intune Permissions**

   - Select **Microsoft Graph**
   - Choose **Application permissions**
   - Search for and add the following permissions:

     - `Organization.Read.All`
     - `DeviceManagementApps.ReadWrite.All`
     - `DeviceManagementConfiguration.ReadWrite.All`
     - `DeviceManagementServiceConfig.ReadWrite.All`

![Microsoft Graph application permissions selected for Intune](/attachments/capaone/63d0c366-f05e-435c-b9bb-d3c0ef0abbab.png)

6. **Grant Admin Consent**

   - After adding permissions, click **Grant admin consent** for your organization.

![API permissions list after granting admin consent](/attachments/capaone/3747faf1-9c5f-4c04-a408-dc6aa9188b35.png)

7. **Verify Permissions**

   - Ensure the permissions are listed and show as "Granted for \[Your Organization\]"

#### Your app permissions should look like this

![Granted Intune permissions listed for the organization](/attachments/capaone/a01d8e4e-8056-4736-89f0-6f14bfb78fe3.png)

## Additional resources

- [Microsoft: Permissions reference for Microsoft Graph](https://learn.microsoft.com/en-us/graph/permissions-reference)