Ensure at least one Intune Multi Admin Approval policy is configured

Contributed by Nicola SuterAll contributors →

Part of Maester · Intune · Tenant administration · All checks

Run this check

Invoke-Maester -TestId MT.1096

Overview

Ensure at least one Intune Multi Admin Approval Policy is configured. Microsoft Intune Multi Admin Approval helps to limit the impact of compromised administrators by requiring approval for sensitive activities.

Remediation action:

To create a multi admin approval policy:

1. Navigate to Microsoft Intune admin center.
2. Click Tenant Administration and select Multi Admin Approval or use the Microsoft Intune Portal - Multi Admin Approval direct link.
3. Select Access policies and create a new access policy, e.g. for Scripts
4. Let another Intune Administrator approve your request to create the access policy
5. Re-visit the access policies section and complete the policy creation.

Additional information:

• Use Access policies to require Multi Admin Approval

Details

Every attribute of this check

Field	Value
Test ID	MT.1096
Severity	Medium
Suite	Maester
Product	Intune
Feature	Tenant administration
Area	Privileged access
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1072 Software Deployment Tools, T1078.004 Cloud Accounts
Supports controls	nist-800-53-r5:AC-3(2), nist-800-53-r5:CM-5(4)
PowerShell test	Test-MtOperationApprovalPolicies
Services	Graph
Compatible licenses	INTUNE_A

Source

• Test: tests/maester/intune/Test.MT.1096.ps1
• Documentation: tests/maester/intune/Test.MT.1096.md