diff --git a/docs/Setup-AppRegistration.ps1 b/docs/Setup-AppRegistration.ps1
index f9d2a97..5dcd861 100644
--- a/docs/Setup-AppRegistration.ps1
+++ b/docs/Setup-AppRegistration.ps1
@@ -33,7 +33,9 @@
 
 .PARAMETER IncludeDeviceActions
     Nimmt zusaetzlich die Berechtigungen fuer den Geraete-Tab auf
-    (Read + ReadWrite + PrivilegedOperations = Sync/Reboot/Lock/Wipe/Retire).
+    (Read + ReadWrite + PrivilegedOperations = Sync/Reboot/Lock/Wipe/Retire)
+    sowie DeviceManagementServiceConfig.Read.All fuer den Autopilot-Status
+    im Detail-Panel.
 
 .PARAMETER GrantAdminConsent
     Erteilt direkt tenantweiten Admin-Consent fuer die gesetzten Scopes.
@@ -78,12 +80,16 @@ $perms = if ($ReadOnly) {
       'DeviceManagementApps.ReadWrite.All','DeviceManagementConfiguration.ReadWrite.All','offline_access')
 }
 if ($IncludeDeviceActions) {
+    # DeviceManagementServiceConfig.Read.All: Autopilot-Status im Geraete-Detail
+    # (Profil-Zuweisung / letzter Kontakt) — ansonsten bleibt das Feld leer.
     $perms += if ($ReadOnly) {
-        @('DeviceManagementManagedDevices.Read.All')
+        @('DeviceManagementManagedDevices.Read.All',
+          'DeviceManagementServiceConfig.Read.All')
     } else {
         @('DeviceManagementManagedDevices.Read.All',
           'DeviceManagementManagedDevices.ReadWrite.All',
-          'DeviceManagementManagedDevices.PrivilegedOperations.All')
+          'DeviceManagementManagedDevices.PrivilegedOperations.All',
+          'DeviceManagementServiceConfig.Read.All')
     }
 }
 if ($IncludeOffboarding) {
@@ -99,6 +105,11 @@ if ($IncludeOffboarding) {
     )
 }
 $perms = $perms | Select-Object -Unique
+# ServiceConfig: ReadWrite (Offboarding) schliesst Read (Autopilot-Anzeige) ein
+# -> die Read-Variante nicht zusaetzlich anfordern.
+if ($perms -contains 'DeviceManagementServiceConfig.ReadWrite.All') {
+    $perms = @($perms | Where-Object { $_ -ne 'DeviceManagementServiceConfig.Read.All' })
+}
 
 # --- Verbinden ----------------------------------------------------------------
 Write-Host "[1/6] Mit Microsoft Graph verbinden (Admin noetig)..." -ForegroundColor Cyan