> For the complete documentation index, see [llms.txt](https://docs.patchmypc.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.patchmypc.com/patch-my-pc-publisher/requirements/configmgr-requirements/permissions.md).
# ConfigMgr Permission Requirements for Patch My PC Publisher
*Applies to: Patch My PC Publisher V3.x*
Patch My PC (PMPC) Publisher has the following Microsoft ConfigMgr Software Requirements:
* [Security Role](#configmgr-security-role)
* [Content Source Folder](#content-source-folder)
## ConfigMgr Security Role
Publisher can create, manage, update, and delete applications in ConfigMgr as well as perform other functions like triggering a Software Update Point (SUP) sync.
In order to be able to perform these functions, Publisher requires the following permissions in ConfigMgr:
* **Application:** Read, Modify, Delete, Set Security Scope, Create, Move Object, Modify Folder
* **Distribution Point:** Read, Copy to Distribution Point
* **Distribution Point Group:** Read, Copy to Distribution Point Group
* **Folder Class:** Read, Modify, Create
* **Security Scopes:** Read
* **Site:** Read
* **Software Updates:** Read, Modify
The **PatchMyPCService** service runs in the **SYSTEM** context by default.
If Publisher is installed on the ConfigMgr Site Server, no further action is required as the **SYSTEM** account has the required access.
However, if Publisher is installed on a remote server, the **Computer$** account of that server will require the permissions detailed above.
{% hint style="info" %}
**Note**
During a scheduled sync, these operations are performed under the context of the logon account specified for the **PatchMyPCService**. By default, this will be **SYSTEM**. Tasks performed manually in Publisher are performed under the context of the currently logged-on user.
{% endhint %}
More details can be found in the following KB, including how to create a custom Security Role to grant these permissions.
{% embed url="" %}
## Content Source Folder
To create, manage, and update third-party application content in ConfigMgr, Publisher needs at least the **Modify** permission on both the SMB share and NTFS folder you specify as the **Source Folder** during configuration.
Connections to the application source UNC path are performed using the server's computer account because the Publisher service runs in the **SYSTEM** context. This applies whether content is being created, updated, or cleaned up.
Because of this, the computer account must be granted the appropriate permissions at both the SMB share level and NTFS folder level.
The minimum required permission is **Modify**. This allows Publisher to create folders, write application content, update files during application revisions, and remove content when applications are deleted.
In this example, Publisher is installed on **BB-CM1**, and the application source folder is hosted on **BB-APP1**. As Publisher accesses the content over SMB, all file operations authenticate as **BB-CM1$**.
To ensure application creation and management works correctly, **BB-CM1$** must be granted **Modify** permissions on the SMB share and the underlying NTFS folder on **BB-APP1**. Without these permissions, application creation, updates, or cleanup operations will fail.
{% hint style="info" %}
**Note**
Publisher automatically creates a root folder called **Applications** (which cannot be changed) in the configured UNC source path.
{% endhint %}
All application content generated by Publisher is stored beneath this folder, with vendor and product-specific subfolders created automatically as applications are published.
{% hint style="success" %}
**Tip**
Each application version is stored in its own UniqueID folder. This results in multiple UniqueID folders under a single application folder, allowing Publisher to track individual application versions and manage application lifecycles correctly.
Application content is stored using the following structure:
**SourceFolder\Applications\Vendor\Application\UniqueID**
When application retention is enabled, retained application content UniqueID folders are moved into a **Retained Apps** folder under:
**SourceFolder\Applications\Vendor\Application.**
{% endhint %}
{% hint style="danger" %}
**Important**
The **Applications** folder structure is critical to Publisher operations. Publisher evaluates both the ConfigMgr database object and the corresponding content directories when making decisions about application retention, upgrades, and lifecycle management.
Manually modifying, moving, or deleting folders within this structure can cause inconsistencies between ConfigMgr and the content source, leading to unexpected behavior or management issues later.
{% endhint %}
{% hint style="info" %}
**Note**
See [Connection and Source Options](/patch-my-pc-publisher/manage/configmgr-apps-tab/base-install-options/connection-source-options.md) for more information.
{% endhint %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.patchmypc.com/patch-my-pc-publisher/requirements/configmgr-requirements/permissions.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.