Sign-in requests delegated access to User.Read, openid, and profile only, so IntuneGet can read your basic work profile.

Intune actions run server-side through an app registration your admin approves, so privileged Graph access is never handed to the browser.

See the full permission list and data flow