# Ensure at least one Intune Multi Admin Approval policy is configured

Ensure at least one Intune Multi Admin Approval policy is configured. A Maester check for Intune, Tenant administration.

Source: https://maester.dev/docs/tests/MT.1096

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/nicolonsky" title="Nicola Suter · Original author"><img src="https://github.com/nicolonsky.png" alt="Nicola Suter" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/nicolonsky">Nicola Suter</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Intune · Tenant administration · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1096
```

## Overview

Ensure at least one Intune Multi Admin Approval Policy is configured. Microsoft Intune Multi Admin Approval helps to limit the impact of compromised administrators by requiring approval for sensitive activities.

#### Remediation action:

To create a multi admin approval policy:
1. Navigate to [Microsoft Intune admin center](https://intune.microsoft.com).
2. Click **Tenant Administration** and select **Multi Admin Approval** or use the [Microsoft Intune Portal - Multi Admin Approval direct link](https://intune.microsoft.com/#view/Microsoft_Intune_DeviceSettings/TenantAdminMenu/~/multiAdminApproval).
3. Select **Access policies** and create a new access policy, e.g. for Scripts
4. Let another Intune Administrator approve your request to create the access policy
5. Re-visit the access policies section and complete the policy creation.

Additional information:

* [Use Access policies to require Multi Admin Approval](https://learn.microsoft.com/intune/intune-service/fundamentals/multi-admin-approval)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1096 |
| Severity | Medium |
| Suite | Maester |
| Product | Intune |
| Feature | Tenant administration |
| Area | Privileged access |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1072 Software Deployment Tools, T1078.004 Cloud Accounts |
| Supports controls | nist-800-53-r5:AC-3(2), nist-800-53-r5:CM-5(4) |
| PowerShell test | [Test-MtOperationApprovalPolicies](https://github.com/maester365/maester/blob/main/tests/maester/intune/Test.MT.1096.ps1) |
| Services | Graph |
| Compatible licenses | INTUNE_A |

</details>

## Source

- Test: [`tests/maester/intune/Test.MT.1096.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/intune/Test.MT.1096.ps1)
- Documentation: [`tests/maester/intune/Test.MT.1096.md`](https://github.com/maester365/maester/blob/main/tests/maester/intune/Test.MT.1096.md)