Require multi admin approval for sensitive Intune changes

Description

Intune Multi Admin Approval access policies protect at least these resource types: Device actions (wipe, retire, delete), Scripts (Windows PowerShell scripts), Apps and Role-based access control. Each access policy names an approver security group of at least two administrators other than the requesters. Compliance policies, configuration policies and tenant configuration can be added according to the organization's change process.

Rationale

Attackers who take over an Intune administrator account have used it to wipe thousands of devices or to deploy malware as a script to the whole fleet in minutes. Requiring a second administrator to approve these changes turns a single account compromise into a request that a human must validate, and records a business justification for every change. Approvals also apply to automation calling the Microsoft Graph API.

Impact

Protected changes wait for approval (requests expire after 3 days) and the requester must then select Complete. Intune sends no notification: approvers must check the Received requests page or be contacted directly. Automation that modifies protected resources must handle the approval workflow, or be excluded explicitly (app exclusions apply to app-only calls and weaken the protection). Protecting the Role type first can deadlock the RBAC assignments that approvals rely on: configure it last.

Applies when

Requires: Microsoft Intune

Audit

1. Sign in to the Microsoft Intune admin center (https://intune.microsoft.com) as at least a Global Reader (or an account with the Read access policy permission).
2. Browse to Tenant administration > Multi Admin Approval > Access policies.
3. Check that policies exist for Device actions, Scripts, Apps and Role-based access control, each with an approver group of at least two administrators, and review the enterprise applications excluded from each policy.
4. Alternative, read only: Invoke-MgGraphRequest -Method GET -Uri https://graph.microsoft.com/beta/deviceManagement/operationApprovalPolicies (scope DeviceManagementRBAC.Read.All).
5. Fail if no access policy exists, or if device actions or scripts are not protected.

Remediation

1. Create a security group of approvers (at least two administrators, direct members), and add the group as a member group of an Intune role assignment with the read permissions of the protected resources.
2. Browse to Tenant administration > Multi Admin Approval > Access policies > Create. Role: Intune Administrator, or a custom role with the Multi Admin Approval access policy permissions.
3. Choose the Profile type (start with Device actions), select the approver group, keep Exclusions empty, enter a business justification and select Submit for approval.
4. Have another administrator approve the access policy, then select Complete with the first account.
5. Repeat for Scripts, Apps, and finally Role-based access control.

Rollback

Delete the access policy (this change also needs a second administrator's approval).

References

• Use Multi Admin Approval in Intune Microsoft, vendor-doc, accessed 2026-10-24
• Maester test MT.1096 Maester, tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle