{
  "id": "CB-M365-DEVICE-011",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-011",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-011.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-011.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-DEVICE-011",
    "title": "Require multi admin approval for sensitive Intune changes",
    "finding": {
      "title": "Intune applies sensitive changes without a second administrator's approval",
      "description": "A single compromised Intune administrator account can wipe the fleet, push a script to every device or change roles without anyone else approving."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "intune",
      "multi-admin-approval",
      "privileged-access",
      "change-control",
      "ransomware"
    ],
    "applicability": {
      "requires": [
        "Microsoft Intune"
      ]
    },
    "description": "Intune **Multi Admin Approval** access policies protect at least these resource types:\n**Device actions** (wipe, retire, delete), **Scripts** (Windows PowerShell scripts), **Apps** and\n**Role-based access control**. Each access policy names an approver security group of at least\ntwo administrators other than the requesters. Compliance policies, configuration policies and\ntenant configuration can be added according to the organization's change process.\n",
    "rationale": "Attackers who take over an Intune administrator account have used it to wipe thousands of\ndevices or to deploy malware as a script to the whole fleet in minutes. Requiring a second\nadministrator to approve these changes turns a single account compromise into a request that a\nhuman must validate, and records a business justification for every change. Approvals also\napply to automation calling the Microsoft Graph API.\n",
    "impact": "Protected changes wait for approval (requests expire after 3 days) and the requester must then\nselect **Complete**. Intune sends no notification: approvers must check the **Received\nrequests** page or be contacted directly. Automation that modifies protected resources must\nhandle the approval workflow, or be excluded explicitly (app exclusions apply to app-only calls\nand weaken the protection). Protecting the **Role** type first can deadlock the RBAC assignments\nthat approvals rely on: configure it last.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Intune admin center (https://intune.microsoft.com) as at least a\n   Global Reader (or an account with the **Read access policy** permission).\n2. Browse to **Tenant administration** > **Multi Admin Approval** > **Access policies**.\n3. Check that policies exist for **Device actions**, **Scripts**, **Apps** and **Role-based\n   access control**, each with an approver group of at least two administrators, and review the\n   enterprise applications excluded from each policy.\n4. Alternative, read only: `Invoke-MgGraphRequest -Method GET -Uri\n   https://graph.microsoft.com/beta/deviceManagement/operationApprovalPolicies` (scope\n   `DeviceManagementRBAC.Read.All`).\n5. Fail if no access policy exists, or if device actions or scripts are not protected.\n"
    },
    "remediation": {
      "manual": "1. Create a security group of approvers (at least two administrators, direct members), and add\n   the group as a member group of an Intune role assignment with the read permissions of the\n   protected resources.\n2. Browse to **Tenant administration** > **Multi Admin Approval** > **Access policies** >\n   **Create**. Role: Intune Administrator, or a custom role with the Multi Admin Approval\n   access policy permissions.\n3. Choose the **Profile type** (start with **Device actions**), select the approver group, keep\n   **Exclusions** empty, enter a business justification and select **Submit for approval**.\n4. Have another administrator approve the access policy, then select **Complete** with the\n   first account.\n5. Repeat for **Scripts**, **Apps**, and finally **Role-based access control**.\n",
      "rollback": "Delete the access policy (this change also needs a second administrator's approval).\n"
    },
    "references": [
      {
        "title": "Use Multi Admin Approval in Intune",
        "url": "https://learn.microsoft.com/intune/fundamentals/role-based-access-control/multi-admin-approval",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Maester test MT.1096",
        "url": "https://maester.dev/docs/tests/MT.1096",
        "publisher": "Maester",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3(2)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-5",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1485"
      },
      {
        "framework": "mitre-attack",
        "id": "T1072"
      },
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}