MT.1096 - Intune Multi Admin approval should be configured

Overview

Ensure at least one Intune Multi Admin Approval Policy is configured. Microsoft Intune Multi Admin Approval helps to limit the impact of compromised administrators by requiring approval for sensitive activities.

Remediation action:

To create a multi admin approval policy:

1. Navigate to Microsoft Intune admin center.
2. Click Tenant Administration and select Multi Admin Approval or use the Microsoft Intune Portal - Multi Admin Approval direct link.
3. Select Access policies and create a new access policy, e.g. for Scripts
4. Let another Intune Administrator approve your request to create the access policy
5. Re-visit the access policies section and complete the policy creation.

Additional information:

• Use Access policies to require Multi Admin Approval

Test Metadata

Field	Value
Test ID	MT.1096
Severity	Medium
Suite	Maester
Category	Intune
PowerShell test	Test-MtOperationApprovalPolicies
Tags	Intune, Maester, MT.1096

Source

• Pester test: tests/Maester/Intune/Test-MtIntunePlatform.Tests.ps1
• PowerShell source: powershell/public/maester/intune/Test-MtOperationApprovalPolicies.ps1