diff --git a/windows/deployment/update/includes/wufb-reports-admin-center-permissions.md b/windows/deployment/update/includes/wufb-reports-admin-center-permissions.md index 05d3a799e1..b54639dfe6 100644 --- a/windows/deployment/update/includes/wufb-reports-admin-center-permissions.md +++ b/windows/deployment/update/includes/wufb-reports-admin-center-permissions.md @@ -10,22 +10,24 @@ ms.localizationpriority: medium --- -**Roles for enrolling into Windows Update for Business reports** +**Enrolling into Windows Update for Business reports** -To enroll into Windows Update for Business reports, edit configuration settings, display and edit the workbook, and view the **Windows** tab in the **Software Updates** page from the [Microsoft 365 admin center](https://admin.microsoft.com) use one of the following roles: +To enroll into Windows Update for Business reports from the [Azure portal](portal.azure.com) or the [Microsoft 365 admin center](https://admin.microsoft.com) requires one of the following roles: - [Global Administrator role](/azure/active-directory/roles/permissions-reference#global-administrator) - [Intune Administrator](/azure/active-directory/roles/permissions-reference#intune-administrator) - [Windows Update deployment administrator](/azure/active-directory/roles/permissions-reference#windows-update-deployment-administrator) - [Policy and profile manager](/mem/intune/fundamentals/role-based-access-control#built-in-roles) Intune role -**Roles for reading Windows Update for Business reports**: +> [!IMPORTANT] +> At minimum, the Log Analytics Reader role (or equivalent permissions) needs to be assigned to the user all of the above enrollment roles because they don't have the permissions by default. + +**Read Windows Update for Business reports data**: The data for Windows Update for Business reports is routed to a Log Analytics workspace for querying and analysis. To display or query any of Windows Update for Business reports data, users must have the following roles, or the equivalent permissions: - [Log Analytics Reader](/azure/role-based-access-control/built-in-roles#log-analytics-reader) role can be used to read data -- [Log Analytics Contributor](/azure/role-based-access-control/built-in-roles#log-analytics-contributor) role can be used if write access to the Log Analytics workspace is needed +- [Log Analytics Contributor](/azure/role-based-access-control/built-in-roles#log-analytics-contributor) role can be used if write access is needed > [!IMPORTANT] -> - At minimum, the Log Analytics Reader role (or equivalent permissions) need to be assigned to all of the above enrollment roles because they don't have the permissions by default. -> - Assigning either of the Log Analytics roles alone allows access to the [workbook](../wufb-reports-use.md), but doesn't allow access to the Microsoft 365 admin center. +> Assigning either of the Log Analytics roles alone allows access to the [workbook](../wufb-reports-use.md), but doesn't allow access to the Microsoft 365 admin center.