Protect Your Intune Configurations with Multi-Admin Approval

Introduction

In today's digital landscape, protecting sensitive data and configurations is crucial. Microsoft Intune provides a powerful tool called Access Policies to help organizations enhance security by requiring multiple administrative approvals for critical changes. This feature, known as Multi-Admin Approval (MAA), ensures that changes are thoroughly reviewed and approved before being implemented, minimizing the risk of unauthorized alterations.

How MAA Works

With MAA, you can configure Access Policies to protect specific Intune configurations, such as app deployments and script executions. When an administrator attempts to make changes to a protected resource, Intune requires a second administrative account to approve the change before it takes effect.

Only administrators who are members of an approval group assigned to the protected resource can approve or reject change requests. This ensures that changes are scrutinized by authorized individuals who have the necessary knowledge and authority.

Benefits of MAA

Implementing MAA offers several benefits:

• Enhanced Security: By requiring multiple approvals, you reduce the risk of unauthorized changes and protect sensitive data from potential breaches.
• Improved Accountability: The approval process creates a clear audit trail, ensuring accountability for changes made to critical configurations.
• Reduced Risk of Errors: Multiple approvals help catch errors and prevent accidental modifications that could disrupt operations.

Creating an Access Policy

To create an Access Policy, follow these steps:

1. Navigate to the Access Policies page:
   • Sign in to the Microsoft Intune admin center (https://intune.microsoft.com/).
   • In the left navigation pane, click "Tenant administration."
   • Under "Multi Admin Administration," click "Access policies."
2. Click "Create" to start creating a new policy:
   • On the "Access policies" page, click the "Create" button.
3. Configure the Basics:
   • On the "Basics" page, provide a meaningful Name for the policy.
   • Optionally, you can give a description description description to explain the purpose of the policy further.
   • Select the Profile type that you want to protect. Each policy can protect a single profile type, such as Apps, Scripts, or Device Configuration.
4. Add Approvers:
   • On the "Approvers" page, click "Add groups" to select the group of administrators who will be responsible for approving changes to the protected resources.
   • You can add multiple approval groups if desired.
   • Note that more complex configurations, such as excluding specific groups from the approval process, are not currently supported.
5. Review and Create:
   • On the "Review + Create" page, review the policy settings to ensure they are correct.
   • Click "Create" to save the policy.

Submitting a Change Request

When making changes to a protected resource, you will be prompted to provide a business justification. This justification will be reviewed by the approvers.

Approving or Rejecting Requests

Approvers can review change requests on the "Received requests" page in the Intune admin center. They can approve or reject requests based on the provided justification and their own knowledge and authority.

Additional Considerations

• Intune does not send notifications when new requests are created or the status of an existing request changes. It is recommended to reach out to approvers for urgent requests.
• Monitor the status of your requests through the "My requests" page in the Intune admin center.
• A new request cannot be submitted for an object that already has pending approval.
• All actions for a protected resource are protected, including edit, create, modify, delete, and assign.
• Actions for requests and the approval process are logged in the Intune audit logs.

Conclusion

Multi-Admin Approval is a valuable tool that helps organizations protect their Intune configurations and enhance security. By requiring multiple administrative approvals, you can reduce the risk of unauthorized changes, improve accountability, and minimize the potential for errors. Implementing MAA ensures that authorized individuals carefully consider and approve critical changes, safeguarding your data and operations.