Pular para o conteúdo principal

DEV-119 - Multi-Admin Approval

Implementation Effort: Medium – Requires enabling access policies, designating approver groups, and updating automation scripts or exclusions for Graph API enforcement.

User Impact: Medium – Transparent to end users, but directly impacts administrative workflows and enforces approval requirements on automated Microsoft Graph API calls.

Overview​

Multi-Admin Approval (MAA) in Microsoft Intune requires that high-impact administrative actions be approved by a second administrator before they take effect. This prevents a single compromised or malicious admin account (or service principal) from making unauthorized or destructive changes.

Recent 2026 updates significantly expanded Multi-Admin Approval across the Intune management plane:

  • Expanded Workload Coverage: In addition to Apps and Scripts, MAA now supports Device Compliance policies, Device Configuration policies (Settings Catalog), Device Categories, Role-based access control (RBAC) changes, and staged Deployment Plans.
  • Microsoft Graph API & Automation Enforcement: MAA now enforces dual authorization on API calls made by automation (service principals, PowerShell scripts, and third-party apps) through the Microsoft Graph API. Automated calls that modify protected resources without required approval headers return an HTTP 403 error unless the application is explicitly added to the Exclusions tab in the access policy wizard.
  • Inline Change Review Agent (Security Copilot): For Windows PowerShell scripts, the Change Review Agent surfaces risk-based recommendations directly inside the Multi-Admin Approval queue (Agent Response column), helping approvers evaluate script behavior before approving or denying.

This supports Assume breach by ensuring that even if an admin account or automation service principal is compromised, critical changes require a second trusted party to approve. It supports Verify explicitly by adding an explicit verification and AI-assisted risk review layer for sensitive operations.

Key Configuration Steps​

  1. Enable Multi-Admin Approval access policies in Tenant administration > Multi Admin Approval.
  2. Define access policies covering Apps, Scripts, Device compliance policies, Settings catalog policies, Device categories, and RBAC.
  3. Designate approver security groups (separate from the administrators requesting changes).
  4. Audit automation scripts and service principals calling Microsoft Graph API; update scripts to use the MAA Graph approval workflow or configure targeted app-auth exclusions in the Exclusions tab.
  5. Enable the Change Review Agent in Security Copilot to provide inline script risk analysis for MAA approvers.
  6. Monitor and review approval activity logs and Admin tasks regularly.

Reference​