Microsoft Intune

Use Multi Admin Approval in Intune

7 August 2026Updated+31 / −4 lines

In brief

The documentation now clarifies that MAA covers delegated actions and app-authenticated Microsoft Graph API calls when policies are already configured. It also documents per-policy enterprise application exclusions for app-auth calls, including a 50-application limit, second-admin approval, and audit logging.

What Intune admins need to know

Review automation and service-principal access, approver Read permissions, direct group membership, and application exclusions. Delegated calls remain subject to MAA, while excluded app-auth applications can bypass approval for the affected resource type.

This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.

Documentation change

Open full page diff →

The comparison below shows only the changed extract. Open the full-page diff for complete context.

title: Use Multi Admin Approval in Intune description: Configure Multi Admin Approval to protect your tenant against the use of compromised administrative accounts in Intune. ms.date: ~~06/15/~~07/30/2026 ms.topic: how-to ai-usage: ai-assisted ms.reviewer: davidra

When you use any account in the tenant to make a change to a resource that's protected by an access policy, Intune doesn't apply the change until a different account explicitly approves it. Only administrators who are members of an approval group that an access protection policy assigns a protected resource to can approve changes. Approvers can also reject change requests.

MAA enforcement applies to both interactive (delegated) admin actions and application-authenticated (app-auth) API calls made through the Microsoft Graph API. If your organization uses service principals, automation scripts, or third-party applications to manage Intune ~~supports~~resources via the Microsoft Graph API, those calls are also intercepted by MAA when the target resource is protected by an access ~~policies for the following resources:~~policy. For details on how to update your automation to work with MAA, see Use Multi Admin Approval with the Microsoft Graph API. To exclude specific apps from enforcement, see Exclude enterprise applications from an access policy.

~~Apps – Applies to app deployments~~
Tip
MAA enforcement on API calls made by automation applies only to tenants that already have MAA access policies configured. It doesn't enable MAA or change any tenant's enrollment.

Intune supports access policies for the following resources:
- Apps – Applies to app deployments, but doesn't apply to app protection policies.
  To approve or reject MAA requests submitted by other admins, an account must meet all of the following requirements:
1. Approver group membership: The account must be a member of the approver group that's assigned to the access policy for the specific resource type.
2. Intune role permission: The approver account must have the resource-specific Read ~~permissions~~ permission for the policy type they ~~are~~'re approving. For example, to approve a request for a device delete action, the approver must have ManagedDevices/Read. For a full list of available permissions, see Custom role permissions.
3. RBAC role assignment for the group: The approver security group itself must be added as a member group to at least one Intune role assignment. If the approver group isn't added to a role assignment, approver group members are removed from the group periodically.
Important
The approver group has two requirements:
- It must be a security group. Distribution lists, Microsoft 365 groups, and mail-enabled security groups aren't supported and silently fail to resolve approver membership.
- It must be directly assigned to an RBAC role in Intune as a member group. Intune role permissions held by individual members, whether through other groups or direct user assignments, don't satisfy this requirement.
- Users must be direct members of the assigned groups. Nested group memberships may result in unreliable behavior.
Role 3: Change requestor
1. On Approvers, select Add groups and then select a group as the group of approvers for this policy. More complex configurations that exclude groups aren't supported.
2. On Exclusions, optionally select Add enterprise applications to exclude specific enterprise applications that use app-auth tokens from MAA enforcement for this policy. Excluded applications can modify protected resources without going through the approval workflow. For more information, see Exclude enterprise applications from an access policy.
3. On Review + submit for approval, review the policy summary including the basics, approvers, and any exclusions. Enter a Business justification, and then select Submit for approval.
4. Next, use a separate administrative account with Approval for Multi Admin Approval permission to sign in to the admin center to review and approve the new access policy.
5. Sign back in to the admin center with the first admin account that created the access policy, view the policy, and finalize it by selecting Complete. After Intune applies this policy, configurations for the protected profile type require multiple admin approvals.
Exclude enterprise applications from an access policy
When you create or edit an access policy, you can exclude specific enterprise applications from MAA enforcement for that policy. Excluded applications can modify the protected resource type without going through the approval workflow.
Important
Exclusions apply only to app-auth (application-authenticated) calls. Calls made with delegated authentication are always subject to MAA enforcement, even if the application is excluded.

[!WARNING] Excluding an application bypasses MAA protection for the affected resource type. Each exclusion creates a gap in your approval workflow that could be exploited if the excluded application is compromised. Only exclude applications when necessary, and review your exclusion list regularly to remove entries that are no longer needed.

Keep the following details in mind:
- Per-policy scope — Each exclusion applies only to the access policy where it's configured. An exclusion in one access policy doesn't affect other policies or workloads.
- Limit — App exclusions are capped at 50 applications per access policy.
- Approval required — Adding, removing, or modifying exclusions requires approval by a second administrator, just like other access policy changes.
- Audit logging — All add, remove, and modify actions on the exclusion list are captured in the Intune audit log.
Submit a request

To submit a request when Multi Admin Approval is enabled, use your normal process to create or edit a resource.
Related content
- Use Multi Admin Approval with the Microsoft Graph API
- Manage role-based access control

@@ -1,7 +1,7 @@ --- title: Use Multi Admin Approval in Intune description: Configure Multi Admin Approval to protect your tenant against the use of compromised administrative accounts in Intune.-ms.date: 06/15/2026+ms.date: 07/30/2026 ms.topic: how-to ai-usage: ai-assisted ms.reviewer: davidra@@ -19,6 +19,11 @@ By using Multi Admin Approval, you can configure access policies that protect sp  When you use any account in the tenant to make a change to a resource that's protected by an access policy, Intune doesn't apply the change until a different account explicitly approves it. Only administrators who are members of an approval group that an access protection policy assigns a protected resource to can approve changes. Approvers can also reject change requests. +MAA enforcement applies to both interactive (delegated) admin actions and application-authenticated (app-auth) API calls made through the Microsoft Graph API. If your organization uses service principals, automation scripts, or third-party applications to manage Intune resources via the Microsoft Graph API, those calls are also intercepted by MAA when the target resource is protected by an access policy. For details on how to update your automation to work with MAA, see [Use Multi Admin Approval with the Microsoft Graph API](multi-admin-approval-graph-api.md). To exclude specific apps from enforcement, see [Exclude enterprise applications from an access policy](#exclude-enterprise-applications-from-an-access-policy).++> [!TIP]+> MAA enforcement on API calls made by automation applies only to tenants that already have MAA access policies configured. It doesn't enable MAA or change any tenant's enrollment.+ Intune supports access policies for the following resources:  - Apps – Applies to [app deployments](../../app-management/deployment/index.md), but doesn't apply to app protection policies.  @@ -64,13 +69,14 @@ To create and manage access policies, use an account with one of the following o To approve or reject MAA requests submitted by other admins, an account must meet all of the following requirements:  1. **Approver group membership**: The account must be a member of the approver group that's assigned to the access policy for the specific resource type.-2. **Intune role permission**: The account must have the resource-specific Read permissions for the policy type they are approving. +2. **Intune role permission**: The approver account must have the resource-specific *Read* permission for the policy type they're approving. For example, to approve a request for a device delete action, the approver must have *ManagedDevices/Read*. For a full list of available permissions, see [Custom role permissions](create-custom-role.md#custom-role-permissions).  3. **RBAC role assignment for the group**: The approver security group itself must be added as a member group to at least one Intune role assignment. If the approver group isn't added to a role assignment, approver group members are removed from the group periodically.     > [!IMPORTANT]    > The approver group has two requirements:    > - It must be a **security group**. Distribution lists, Microsoft 365 groups, and mail-enabled security groups aren't supported and silently fail to resolve approver membership.-   > - It must be directly assigned to an Intune role as a member group. Intune role permissions held by individual members, whether through other groups or direct user assignments, don't satisfy this requirement.+   > - It must be directly assigned to an RBAC role in Intune as a member group. Intune role permissions held by individual members, whether through other groups or direct user assignments, don't satisfy this requirement.+   > - Users must be direct members of the assigned groups. Nested group memberships may result in unreliable behavior.  ### Role 3: Change requestor @@ -111,12 +117,32 @@ If a request isn't processed further within 3 days, it becomes **Expired**, and  1. On *Approvers*, select **Add groups** and then select a group as the group of approvers for this policy. More complex configurations that exclude groups aren't supported. -1. On *Review + Create*, review, and then save your changes.+1. On *Exclusions*, optionally select **Add enterprise applications** to exclude specific enterprise applications that use app-auth tokens from MAA enforcement for this policy. Excluded applications can modify protected resources without going through the approval workflow. For more information, see [Exclude enterprise applications from an access policy](#exclude-enterprise-applications-from-an-access-policy). +1. On *Review + submit for approval*, review the policy summary including the basics, approvers, and any exclusions. Enter a *Business justification*, and then select **Submit for approval**.+    1. Next, use a separate administrative account with **Approval for Multi Admin Approval** permission to sign in to the admin center to review and approve the new access policy.  1. Sign back in to the admin center with the first admin account that created the access policy, view the policy, and finalize it by selecting **Complete**. After Intune applies this policy, configurations for the protected profile type require multiple admin approvals. ++### Exclude enterprise applications from an access policy++When you create or edit an access policy, you can exclude specific enterprise applications from MAA enforcement for that policy. Excluded applications can modify the protected resource type without going through the approval workflow.++> [!IMPORTANT]+> Exclusions apply only to app-auth (application-authenticated) calls. Calls made with delegated authentication are always subject to MAA enforcement, even if the application is excluded.++> [!WARNING]+> Excluding an application bypasses MAA protection for the affected resource type. Each exclusion creates a gap in your approval workflow that could be exploited if the excluded application is compromised. Only exclude applications when necessary, and review your exclusion list regularly to remove entries that are no longer needed.++Keep the following details in mind:++- **Per-policy scope** — Each exclusion applies only to the access policy where it's configured. An exclusion in one access policy doesn't affect other policies or workloads.+- **Limit** — App exclusions are capped at 50 applications per access policy.+- **Approval required** — Adding, removing, or modifying exclusions requires approval by a second administrator, just like other access policy changes.+- **Audit logging** — All add, remove, and modify actions on the exclusion list are captured in the Intune audit log.+ ## Submit a request  To submit a request when Multi Admin Approval is enabled, use your normal process to create or edit a resource.@@ -180,6 +206,7 @@ You can cancel a request before it's approved by selecting it from the **My requ  ## Related content +- [Use Multi Admin Approval with the Microsoft Graph API](multi-admin-approval-graph-api.md) - Manage [role-based access control](../role-based-access-control/overview.md)  <!--links-->