DEV-119 - Multi-Admin Approval
Implementation Effort: Medium – Requires enabling the feature and defining approval policies with designated approvers.
User Impact: Low – Transparent to end users; requires additional approval step for admin actions.
Overview
Multi-Admin Approval (MAA) in Microsoft Intune requires that certain high-impact administrative actions be approved by a second administrator before they take effect. This prevents a single compromised or malicious admin account from making destructive changes such as deleting compliance policies, modifying app protection policies, or removing device configurations.
This supports Assume breach by ensuring that even if an admin account is compromised, critical changes require a second trusted party to approve. It supports Verify explicitly by adding an additional verification layer for sensitive operations. Without multi-admin approval, a single compromised admin can silently weaken the organization's security posture.
Key Configuration Steps
- Enable Multi-Admin Approval in Microsoft Intune
- Define access policies specifying which actions require approval
- Designate approver groups (separate from the administrators requesting changes)
- Configure notification settings so approvers are alerted to pending requests
- Establish SLAs for approval turnaround to avoid operational delays
- Monitor and review approval activity logs regularly