Intune Role - Recovery keys permission

Hi there,

I know, you can assign an RBAC role for EntraID to read the Bitlocker Key directly from Azure, but is it also possible to do so directly from intune and with an intune permission?

I checked again the permissions but could not shrink it down. Currently for the Device Manager role I have following permissions:

Cloud attached devices
- View software updates
- View client details
Enrollment programs
- Sync device
Managed devices
- View reports
- Set primary user
- Read
- Update
- Delete
Operating System Recovery Configurations (This one I tried addtionally)
- Read Profiles
Remote tasks
- Collect diagnostics
- Sync devices.
- Set device name
- Windows defender
- Clean PC
- Run Remediation
- Wipe

Can someone help me with that? Thanks to the speed of intune, after changing the permissions I just have to wait 24 hours ;)