Multi-Admin Approval in Microsoft Intune: Enforcing Dual Authorisation for High-Risk Endpoint Changes

Device management platforms concentrate significant authority in the hands of a small number of administrators. A single operator in Microsoft Intune can push applications, run scripts, and issue remote device actions across an entire fleet, which makes the endpoint management plane an attractive target and a genuine single point of failure. For organisations in government, aged care, and financial services, the risk is not only deliberate abuse but also honest error, where a well-intentioned change made without a second set of eyes causes widespread disruption.

Multi-Admin Approval, often abbreviated to MAA, addresses this exposure by requiring two separate administrators to authorise sensitive operations before they take effect. The feature introduces a structured request and approval workflow directly into the Intune administration experience, so that no individual can both initiate and enact a high-risk change. This article explains how the capability works, where it adds the most value, and how to plan an implementation that aligns with formal change control expectations.

Why dual authorisation matters for endpoint management

Endpoint management actions are unusual in their blast radius. A mistaken application deployment, a flawed configuration script, or an accidental wipe can propagate to thousands of devices within minutes, affecting clinical systems, service delivery, and regulated financial operations. Traditional role-based access control limits who can perform an action, but it does nothing to prevent a privileged administrator from making a damaging change in isolation, whether through compromise, coercion, or simple mistake.

Dual authorisation closes this gap by separating the request from the approval. The principle mirrors long-established financial controls such as the four-eyes rule and segregation of duties, where no single person can complete a sensitive transaction alone. Applied to device management, it means a compromised administrator account or a rushed operator cannot unilaterally alter the estate, because a second, independent administrator must review the business justification and consciously approve the change before it proceeds.

How Multi-Admin Approval works in Intune

Multi-Admin Approval is configured through access policies in the Intune admin centre. Each access policy defines a protected resource type and nominates an approver group whose members are responsible for reviewing requests. When an administrator attempts an operation covered by a policy, Intune intercepts the action and converts it into a pending request rather than applying it immediately. The requester supplies a business justification, and the change remains inactive until an eligible approver accepts it.

A fundamental safeguard is that the administrator who submits a request cannot approve their own request, which enforces genuine separation between the two roles. Protected resource types have historically included application deployments and scripts, with Microsoft extending coverage to additional sensitive operations over time. Because the control operates on the operation itself rather than on broad role assignments, it complements existing permissions instead of replacing them, allowing teams to retain their day-to-day access while adding a checkpoint for the actions that carry the greatest consequences.

Planning and implementing access policies

A successful rollout begins with identifying which operations genuinely warrant dual authorisation. Applying approval to every change would introduce friction and encourage workarounds, so the sensible approach is to protect the actions with the highest potential for harm, such as broad application deployments and script execution. Mapping these operations against your existing change management categories helps ensure that the technical control reflects the organisation's documented risk appetite rather than an arbitrary selection.

Equally important is the design of the approver group. Approvers must be distinct from the administrators who routinely make changes, and the group should be large enough to avoid bottlenecks yet small enough to maintain accountability. Organisations should plan for timely review, define escalation paths for urgent legitimate changes, and ensure approvers understand what a sound business justification looks like so that approval does not become a rubber stamp. Testing the workflow in a controlled environment before enforcing it in production allows teams to validate that genuine operational work can still proceed without undue delay.

Alignment with governance in regulated sectors

For government and financial services, Multi-Admin Approval provides evidence of enforced segregation of duties, a requirement that frequently appears in audit findings and security assessments. The request and approval records create an auditable trail showing who requested a change, what justification they provided, and who authorised it, which supports both internal governance and external assurance activities. This traceability is particularly valuable when demonstrating compliance with frameworks that expect privileged actions to be controlled, logged, and reviewed.

The capability also reinforces the broader strategy of restricting and governing administrative privileges that underpins the Australian Cyber Security Centre's Essential Eight guidance. By requiring a second administrator to sanction high-risk endpoint changes, organisations reduce the value of a single compromised credential and limit the damage any one account can inflict. When combined with privileged identity management, conditional access, and least-privilege role assignments, dual authorisation forms a practical layer of defence in depth that protects the device management plane without obstructing legitimate operational work.

References

• Microsoft Learn: Use access policies and multiple administrative approval with Intune
• Australian Cyber Security Centre: Essential Eight