The Intune service must be configured to implement Multi-Admin Approval (MAA) for wiping managed devices

Contributed by Merill FernandoAll contributors →

Part of DISA · Intune · Tenant administration · All checks

Run this check

Invoke-Maester -TestId DISA.V-285327

Overview

An Intune Multi Admin Approval policy requires a second administrator to approve device wipes. (DISA Microsoft Intune MDM Service Desktop and Mobile STIG, V-285327, CAT I).

One compromised or careless Intune administrator can wipe every managed device in a few clicks. Multi Admin Approval makes a second administrator approve the wipe before it runs, which is why DISA rates this rule CAT I.

This test runs MT.1096 with RequiredPolicyType, so it passes only when an approval policy covers device wipes (a Device wipe or Device actions policy). The STIG also asks you to confirm that the approver group is the right one and that the policy itself is approved; check that by hand.

Remediation action

1. Create a Microsoft Entra security group for the administrators who approve device wipes.
2. In the Microsoft Intune admin center, go to Tenant administration > Multi Admin Approval > Access policies and select Create.
3. Set Policy type to Device wipe (or Device actions), select the approver group, and save.
4. Have another administrator approve the new policy.

Related links

• DISA Microsoft Intune MDM Service Desktop and Mobile STIG: V-285327
• Use Multi Admin Approval in Intune

Details

Every attribute of this check

Field	Value
Test ID	DISA.V-285327
Severity	Medium
Suite	DISA
Product	Intune
Feature	Tenant administration
Area	Privileged access
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1072 Software Deployment Tools, T1078.004 Cloud Accounts
Supports benchmark	DISA Microsoft Intune MDM Service Desktop and Mobile STIG (version V1R2), requirement V-285327
Supports controls	disa-stig-intune-mdm:V-285327, nist-800-53-r5:CM-6
PowerShell test	Test-MtDisaIntuneWipeApproval
Services	Graph
Compatible licenses	INTUNE_A

Source

• Test: tests/disa/Test.DISA.V-285327.ps1
• Documentation: tests/disa/Test.DISA.V-285327.md